Security
If you find a security problem on this website or in one of my apps, please tell me. I would much rather hear about it first.
Report a problem
Email contact@camdenburke.co.uk with "Security" in the subject. Include the page address or app, what you did, what happened, and what you think the impact is. The same details are in security.txt.
- I reply within five working days and keep you updated until it is fixed.
- If you want credit, I will name you once it is fixed. There is no bounty program.
- I will not take legal action against research done in good faith under these rules.
Please
- Do not access, change or keep other people's data. Stop and tell me as soon as you can see any.
- Do not disrupt the site, use automated scanners at volume, or try social engineering against me or anyone else.
- Give me a reasonable time to fix the problem before you publish it. 90 days is a good rule.
How the site is built
- Static pages served by Cloudflare over HTTPS only, with no third-party scripts, trackers or fonts.
- A strict Content Security Policy that blocks inline scripts, plus the usual protective headers.
- The few forms and counters run on a small Worker that limits request size and rate, and stores no IP addresses.
- Private downloads use signed links that expire.