Security
How to report a security problem on this site or one of its subdomains.
Reporting
Email security@taz.tn with what you found, where, and the steps to reproduce it. I read every report myself and reply within a week.
There is no PGP key yet. If a report needs encryption, send a short note first and we’ll agree on a channel.
Scope
taz.tnand its subdomains.
Out of scope:
- the services these sites run on (Netlify, GitHub, OVH): report to them directly
- denial of service, load testing, or scanning heavy enough to degrade a site
- social engineering and physical access
- findings with no security impact, such as missing best-practice headers on a subdomain
Safe harbour
If you test in good faith and within these rules, I won’t take legal action against you or report you to anyone, and I’ll say so if someone else asks. The rules:
- use your own accounts and data; stop and report as soon as you reach someone else’s
- don’t keep, share or change data beyond what shows the problem
- give me 90 days to fix it before you publish, unless we agree otherwise
What you can expect
- a reply within a week, and news when it’s fixed
- no bounty: this is a personal site
- no hall of fame or thanks page