Security
Reporting a vulnerability
Found a security issue in odnd.com? Thank you. Here’s how to report it.
How to report
Reply to any odnd.com newsletter email with the subject “Security report”. Include the affected URL, what you found, steps to reproduce, and the impact you expect. If you aren’t a subscriber, subscribe and reply to the confirmation email.
Please give a reasonable amount of time to fix the issue before disclosing it publicly.
Scope
- In scope: the odnd.com website and its newsletter signup, confirmation, and unsubscribe flows.
- Out of scope: vulnerabilities in the third-party services the site relies on (hosting, database, and email delivery); report those to the provider. Also out of scope: denial-of-service, spam or volume testing, social engineering, and findings that need physical access or a compromised device.
Safe harbor
Good-faith research that follows this page is welcome, and I won’t pursue legal action over it. Please only test with accounts and data you own, don’t access or change other people’s data, stop and report as soon as you find an issue, and don’t degrade the site for other readers. There is no bug bounty.
Machine-readable version: /.well-known/security.txt