Vulnerability Disclosure Policy

I am a solo, independent developer. I take security seriously and genuinely appreciate researchers who find and responsibly disclose issues. There's no bounty program, no guarantee of response time — but I will read every report and act on valid findings.

Scope

Reports are welcome for any system under the hypastack.com domain, including:

• The main web application (hypastack.com)
• The API (hypastack.com/api)
• The file download flow (/d/[id])
• The desktop client (Tauri/Rust app)
• The CDN asset pipeline (r2.hypastack.com)

Out of scope:

• Cloudflare infrastructure (report directly to Cloudflare)
• Social engineering or phishing attacks against my users
• Denial of Service attacks
• Issues requiring physical access to my servers
• Theoretical vulnerabilities with no working proof of concept

What I Actually Can't See

For files uploaded through the website, the contents are mathematically inaccessible to me. The decryption key lives only in the URL fragment and is never transmitted to my servers. If a vulnerability you find only works against that encrypted content layer, please be aware that I cannot "fix" zero-knowledge encryption — that's a feature, not a bug.

This does not apply to CDN assets or to files uploaded through the developer API. Neither is encrypted, both are readable by me, and both are in scope for disclosure in the normal way. A report showing that either can be accessed by someone who should not be able to is a real finding and I want to hear about it.

Vulnerabilities in the authentication flow, access key derivation, metadata endpoints, rate limiting, or any server-side logic are absolutely in scope and worth reporting.

How to Report

Message https://t.me/t_usekiko with the following:

• A clear description of the vulnerability and its potential impact
• Step-by-step reproduction instructions
• A proof of concept if available (screenshots, video, or code)
• Your handle or name if you'd like to be credited

I do not have a dedicated security team. Reports are reviewed by me directly. Please be patient — I will respond.

Rules of Engagement

I ask that you:

• Do not access, modify, or delete data belonging to real users
• Do not disrupt service availability
• Give me reasonable time to fix the issue before public disclosure (I'll aim for 30 days)
• Keep vulnerability details confidential until coordinated disclosure

Safe Harbor

If you follow this policy in good faith, I will not pursue legal action against you. I consider responsible security research a public good and will not characterize it as unauthorized access. This safe harbor applies only when you have not caused material harm to my systems or real user data.

No Bug Bounty

I am a bootstrapped, self-funded solo developer. I cannot offer monetary rewards. What I can offer:

• Public credit in my release notes (with your permission)
• A genuine thank you from me
• The knowledge that you helped protect real users