Disclosure

Security

Found something that shouldn't be there? Good. Here's how to tell me, and what you can expect back.

Scope

This site, sn0walice.dev, and its subdomains.
mlab.sh and the tooling I publish under Sn0wAlice and mlab-sh.
Out of scope: third-party services I don't run, volumetric or denial-of-service testing, and social engineering of me or anyone else.

How to report

Email [email protected] with steps to reproduce and the impact you see.
One clear finding per report beats a scanner dump.
Machine-readable policy lives at /.well-known/security.txt.

What to expect

An acknowledgement, usually within a few days. I'm one person, not a queue.
Honest status updates while I work a fix, and credit if you want it.
Please give me a reasonable window before going public.

Safe harbor

Test in good faith, stay within scope, and don't touch data that isn't yours.
Do that, and I won't come after you. This is a thank-you, not a trap.
Curious? There's a small game hidden on this site for people who read carefully.