Skip to the disclosure policy
Client room Go to the pages

footnote found a weakness?

and if you find a weakness, tell us before anyone else, and we will fix it and say so.

This is how to report a vulnerability in this website, its client rooms, or software we have built, and what we promise in return. It follows the vulnerability disclosure principle of the UK’s Software Security Code of Practice.

A gloved hand holds a rugged phone above the top rail of a wooden farm gate, a pasture and a low hedge beyond, under a flat grey sky.
Report it first. Credited, if you wish.

direct object what to send

write to one address, with what you found:

Email contact@vistarasoftware.site, the address also published in this site’s /.well-known/security.txt. A report in English, as short as it can be while still letting us see the problem for ourselves, is all we need.

  • the page or address where it happens
  • the steps that show it, from a clean start
  • what someone could do with it
  • how to reach you, and whether and how you would like to be credited

To contact@vistarasoftware.site

Subject Security: a short name for the problem

Where: the page or address

Steps: 1, 2, 3, from a clean start

Impact: what someone could do with it

Credit: your name or handle, or none

The shape of a useful report. Plain text is fine; please do not attach anything that runs.

future tense what we commit to

and what happens after you send it:

  1. 2 working daysa reply from a person, acknowledging the report
  2. 10 working daysour first assessment: whether we can reproduce it, and how serious we think it is
  3. every 10 working daysan update until it is fixed, even when the update is that we are still working
  4. within 90 daysa fix for anything we confirm, sooner for anything serious, and a disclosure date agreed with you

When it is fixed, we say so publicly, credit you if you want to be credited, and tell any client whose software was affected. We do not run a reward programme.

In scope

  • this website, vistarasoftware.site, wherever it is served from
  • the brief form, the client rooms and the program behind them
  • software we have built and still support: tell its owner, our client, and copy us, and we will work with both of you

Not in scope

  • services run by other companies, including the network that hosts this site; report those to them
  • findings from automated scanners with no demonstrated impact, such as a missing header on a plain page
  • the domain’s mail settings while its mail is still being switched on

condition testing in good faith

test it as you would want yours tested:

  • Use a client room of your own for testing, and delete it afterwards with Delete my room.
  • Never look at, change or delete anyone else’s data. If you reach any, stop there and tell us.
  • No floods, load tests or automated form sending. The site’s storage has a small daily allowance shared with other services, and a flood would stop the forms working for everyone.
  • No tricking people, no pressure on anyone who works with us, and no attempts at the registered office.
  • Keep the details to yourself until it is fixed, or until the date we agree with you.

↑ ↓ moveEnter goEsc close