Disclosure policy
How to report a security issue in this site, and what to expect.
If you find a security problem in this site, report it to hello@tahag.dev. A machine-readable copy of this policy is at /.well-known/security.txt.
Please include the affected URL, the version or commit if you know it, a reproducer, and the impact you believe it has. Do not test against other readers, do not access data that is not yours, and do not run denial-of-service traffic.
I aim to acknowledge a report within three working days and to give a fix or a reasoned response within thirty days. If the issue is valid, I will credit you in the fix note unless you ask me not to.
I will not pursue legal action for good-faith research that follows this policy. That safe harbour covers this site only, not third-party services it links to or software discussed in a post.
Out of scope: missing headers with no demonstrated impact, automated scanner output, social engineering, physical access, and reports that only affect an outdated browser.