Responsible
Disclosure.
Security is a core principle of this portfolio. I welcome responsible vulnerability reports from security researchers and members of the cybersecurity community. This policy outlines how to report security issues responsibly and what you can expect throughout the disclosure process.
Security Status
Disclosure at a Glance
1. Security Commitment
This website is designed and maintained using security best practices. Despite ongoing testing and monitoring, vulnerabilities may still exist. Responsible disclosure helps improve the security of this portfolio while protecting visitors and infrastructure.
2. Safe Harbor
Researchers acting in good faith and following this policy will not be subject to legal action for their security research. This safe harbor applies only to activities that remain within the scope and guidelines described below.
3. Reporting Guidelines
Allowed Activities
- Verify the vulnerability
- Minimal proof-of-concept
- Responsible disclosure
- Preserve evidence
- Respect privacy
Not Allowed
- DoS / DDoS attacks
- Spam or volumetric fuzzing
- Brute force attacks
- Social Engineering / Phishing
- Data Exfiltration or modification
- Malware deployment
- Physical attacks
4. Scope
In Scope
| Target | Status |
|---|---|
| Main Portfolio | |
| /api/* | |
| Contact Form | |
| Authentication | |
| Supabase RLS |
Out of Scope
| Target | Reason |
|---|---|
| Vercel Infrastructure | Third Party |
| Supabase Platform | Third Party |
| Browser Extensions | Not Controlled |
| DNS Providers | Third Party |
5. What Makes a Good Report
6. Disclosure Process
Report Submitted
Researcher sends details securely.
Acknowledgement
Within 48 hours.
Validation
Verifying the vulnerability and impact.
Patch Development
Building and testing the fix.
Deployment
Patch pushed to production.
Coordinated Disclosure
Mutual agreement on public release.
Researcher Credit
Added to the Hall of Thanks.
7. Response Timeline
| Stage | Target Timeline |
|---|---|
| Acknowledge | 48 Hours |
| Initial Review | 5 Business Days |
| Status Update | As Needed |
| Resolution | Depends on Severity |
8. Recognition
Hall of Thanks
Researchers who responsibly disclose valid vulnerabilities may receive:
This portfolio does not currently operate a monetary bug bounty program. I appreciate the community's efforts in helping secure open and personal projects.
9. Contact
Security Contact
Preferred Format
Encrypted Email (PGP if available)
Reports may be submitted via standard email. If a PGP public key is added in the future, encrypted submissions will be supported and preferred.
Response Window
48 Hours10. Legal Notice
This policy applies only to systems owned and operated by Jothish Gandham.
Testing against third-party services, hosting providers, or vendors is outside the scope of this policy and should be reported directly through their official disclosure programs.