Security · Disclosure policy
Found a vulnerability? Thank you.
We’d be poor security engineers if we didn’t welcome reports about our own systems. Here’s how to send one.
How to report
Email hello@winternitz.tech with a description of the issue, steps to reproduce it and the impact you believe it has. If you need to share sensitive details, say so in your first email and we’ll arrange an encrypted channel. Our machine-readable contact details are in /.well-known/security.txt.
What we ask
- Test only against systems you own or against winternitz.tech itself, and only as much as needed to demonstrate the issue.
- Don’t access, change or delete other people’s data, and don’t degrade the service.
- Give us reasonable time to fix the issue before you disclose it publicly.
What we commit to
- We’ll acknowledge your report within three business days.
- We won’t pursue legal action against good-faith research that follows this policy.
- With your permission, we’ll credit you when the fix is published.