Security & vulnerability disclosure

Waidrn is a small community service. Security reports are welcome and we will treat good-faith research with respect. This page is the disclosure policy referenced by /.well-known/security.txt.

How to report

Email security@waidrn.com with enough detail to reproduce the issue:

the URL or endpoint, and the account type involved;
steps to reproduce, and what you expected vs what happened;
any logs, screenshots or a minimal proof of concept (please do not attach real users' private data);
how you would like to be credited (or say "anonymous").

Do not use the public boards, comments, or the moderation queue to report a vulnerability, and do not test against other people's accounts.

What to expect

acknowledgement within 3 working days;
an initial assessment and severity within 10 working days;
updates when there is something material to share, and a fix or mitigation timeline for confirmed issues;
coordinated disclosure: we will agree a public write-up date with you once a fix is deployed (usually within 90 days).

In scope

waidrn.com application (accounts, sessions, 2FA, content, moderation, projects, wallet and simulated economy);
authentication and authorisation logic, CSRF/XSS/SQL injection, session handling, file/EPUB import handling;
security headers, rate limiting and anti-abuse controls;
secrets accidentally committed to public repositories (report privately first).

Out of scope

denial-of-service or load testing against the live site without written permission;
reports requiring physical access, stolen devices or an already-compromised inbox;
social engineering of operators or users;
content policy complaints (use the report buttons / moderation queue);
the simulated economy's money — it has no real-world value and no withdrawal path;
findings on third-party services we do not control.

Safe harbour

We will not pursue legal action for good-faith research that stays within this policy, avoids privacy violations, avoids service disruption, and gives us reasonable time to fix issues before publication. If in doubt, ask first at the address above.

No bounty

There is no paid bug-bounty programme at this size. We will credit researchers who want it and are happy to confirm the report on request. Please do not send PGP-encrypted mail unless we ask for it; if you need a key, ask the address above and we will coordinate a channel.