If you believe you’ve found a security vulnerability in a MrAI.dev system, we want to hear about it. This policy explains how to report it, what’s in scope, how to test in good faith, and what you can expect from us.
1. How to report
Email david+security@mrai.dev. If you can, encrypt your report with our PGP key:
9284 CF8E C812 BE63 5804 CEAB B3C0 4875 D879 D7AB
The same details are published in machine-readable form in our security.txt, which is signed with that key.
2. What to include
- A description of the issue and its potential impact.
- The affected URL or component.
- Steps to reproduce it, or a proof of concept.
- How to reach you, and whether you’d like to be credited.
3. Scope
In scope: the mrai.dev website (https://mrai.dev/) and its web server.
Out of scope: third-party services we use, such as Google Workspace for email — please report those to the vendor — and other websites linked from this site.
4. Testing guidelines
To stay within this policy:
- Don’t access, modify or delete data that isn’t yours. If you come across personal or confidential information, stop and report it.
- Don’t degrade the site for others — no denial-of-service testing and no high-volume automated scanning.
- Don’t use social engineering, phishing or physical attacks.
- Give us a reasonable amount of time to fix an issue before disclosing it publicly, and coordinate the timing with us.
5. What you can expect from us
- We’ll acknowledge your report and work with you to understand and validate it.
- We’ll keep you informed of our progress and let you know when the issue is fixed.
- With your permission, we’ll credit you for the discovery.
6. Safe harbor
If you make a good-faith effort to follow this policy, we will consider your research authorized, we will not pursue or support legal action against you for it, and we will work with you to understand and resolve the issue quickly.
7. Reports we usually don’t act on
This is a static site with no accounts, forms or user data, so some common findings have little or no impact here. Unless you can show real impact, we generally won’t act on:
- missing or “best practice” HTTP headers or TLS settings;
- clickjacking on pages that have no sensitive actions;
- email-spoofing, SPF, DKIM or DMARC reports;
- unvalidated output from automated scanners;
- issues that require an outdated browser, or physical or privileged access to a user’s device.
8. Rewards
We don’t run a paid bug bounty program, but we’re grateful for every good-faith report.
9. Contact
Security reports: david+security@mrai.dev. Everything else: Contact.