Vulnerability disclosure
How to report a security vulnerability in the Ethotechnics website, APIs, or published standards files, what is in scope, and who reads the report.
Scope
Systems covered by this policy
Report vulnerabilities affecting the public website, APIs, and published machine-readable standards artifacts.
- In scope:
ethotechnics.orgpages and static assets. - In scope: repository code and generated artifacts hosted on this domain.
- Out of scope: third-party services the Institute does not control.
- Out of scope: purely theoretical findings without a reproducible proof.
- Email security@ethotechnics.org with the subject line [Vulnerability report].
- Include an impact summary, the affected URL or path, steps to reproduce, and suggested remediation if available.
- For low-risk issues, you may also email hello@ethotechnics.org and reference this disclosure policy.
- Canonical machine-readable record: /.well-known/security.txt.
Who reads reports
One person reads this inbox
Kanav Jain, the Institute's author, reads security reports. There is no on-call rotation and no promised response time.
- A reply says whether the report could be reproduced and what will change.
- Fixes are made in the public repository, where the change and its date are on the record.
- If a report has gone unanswered and you plan to disclose it, say so in a follow-up email first.
- Credit is given only if you ask for it: say so in the report and give the name and link to use.
Safe harbor
Good-faith research protections
We will not pursue action against good-faith researchers following this policy.
- Avoid privacy violations, data destruction, and service disruption.
- Do not exfiltrate data beyond what is needed to demonstrate impact.
- Give us a reasonable remediation window before public disclosure.