Report a Problem
This is the policy referenced by our security.txt. If you found something wrong with this website, here is how to tell us.
How to Report
Email [email protected]. Include the URL, what you did, and what happened. A screenshot or a curl command beats a paragraph of description.
We are volunteers, not a security team. Expect a human reply within about a week. There is no bug bounty, no swag, and no money — this is a neighborhood mosquito project with a $10 budget. What we can offer is that we will actually read it, actually fix it, and credit you by whatever name you like if you want the credit.
Please report in English if you can. Reports in other languages are still welcome; they will just take longer.
What's In Scope
Everything under dolandskeeterwar.com is in scope. Before you spend time on it, know what this site actually is:
01 It is entirely static
Hand-written HTML, CSS, and JavaScript built by Jekyll and served from a CDN. There is no application server, no database, and no backend to reach.
02 There are no accounts
No login, no session, no password reset, no roles. Nothing to escalate to, because there are no privilege levels at all.
03 There is no user data
No forms that submit anywhere, no analytics, no tracking pixels, no cookies of any kind. The site stores nothing about you, so there is nothing to breach.
04 Everything is single-origin
Every script, style, font, and image is served from this domain. No third-party scripts, no CDN libraries, no embedded iframes.
Given that, the findings we are genuinely interested in are: a way to inject or execute script on a page, a way to modify content that reaches other visitors, a Content Security Policy or header bypass, a subdomain or DNS takeover, and anything that would let someone impersonate this site.
What We'll Decline
⚠ THESE WILL BE CLOSED WITHOUT A FIX
- Automated scanner output with no working example. A grade from a headers tool is not a vulnerability. Show us the impact.
- Missing headers that do nothing here. Cookie flags on a site with no cookies, CSRF tokens on a site with no forms, and similar.
- Missing SPF/DKIM/DMARC findings. The domain publishes
v=spf1 -alland DMARCp=rejectprecisely because it never sends mail. - The
server: cloudflareheader. We know. We are not able to remove it, and it is not an exploit. - Denial of service, load testing, or automated scanning that generates real traffic. Please do not. Read the source instead — it is a public repository.
- Social engineering, or anything aimed at the people involved rather than the site. Contributors here are deliberately anonymous. Leave them alone.
- Compliance-framework gaps. SOC 2, PCI DSS, HIPAA, and ISO 27001 do not apply to a volunteer site that handles no data and takes no payments.
Safe Harbour
If you are researching in good faith, we will not pursue or support any action against you. Good faith means: you stop as soon as you have confirmed the issue, you do not access or modify anyone else's data, you do not degrade the site for other visitors, and you give us a reasonable chance to fix it before publishing.
We have no embargo period to impose and no legal department to route you through. Tell us, give us a couple of weeks, then write it up wherever you like.
This policy is not legal advice and does not authorise you to break any law that applies to you.