Responsible Disclosure

How to report

Write to moc.yks-etihw@ofni with the subject “Security vulnerability”. Please include a description of the issue, the affected address, the steps to reproduce it and its potential impact.

Do not include personal data in your report beyond what is needed to show the issue. We may contact you if we need more information.

Guidelines

When researching and reporting a vulnerability, please:

• act in good faith, and only to the extent needed to show the vulnerability;
• not access, copy, modify or delete data that is not yours, and stop as soon as you reach any personal data;
• not use denial-of-service, spam, social engineering or physical attacks, and not test our people, premises or robots;
• not use automated scanning that degrades the service for others;
• not disclose the issue to anyone else without our written agreement; and
• comply with all applicable laws.

Scope

This policy covers this website only. Third-party services, such as the meeting calendar, should be reported to their operators.

Good-faith research

We do not intend to pursue legal action against anyone who reports a vulnerability to us in good faith and in line with this policy. This statement does not authorise any activity, does not waive any right of White Sky or of any third party, and does not apply to any activity that breaches applicable law or this policy.

No reward

White Sky does not run a bug bounty programme and does not pay for reports. A report does not create any contractual or other relationship with White Sky.

Machine-readable contact

Our contact for security reports is also published at /.well-known/security.txt, in the format of RFC 9116.