Reporting a vulnerability
Send suspected security vulnerabilities to support@delvierre.com with the subject “Security report”. Include the affected URL or function, a clear description, reproducible steps that do not expose personal data, the date/time observed, and a safe way to contact you. Do not include passwords, review tokens, unpublished manuscripts, or personal data in ordinary email unless specifically requested through a secure channel.
Good-faith research rules
- Test only accounts and data you own or are expressly authorised to use.
- Do not access, download, change, delete, or disclose another person's data.
- Do not perform denial-of-service, high-volume scanning, credential attacks, social engineering, spam, or physical attacks.
- Do not upload malware, publish an exploit before remediation, or use a vulnerability for commercial leverage.
- Stop testing and report immediately if you encounter personal data, unpublished manuscripts, secrets, or evidence of active compromise.
What Delvierre will do
Delvierre will acknowledge a sufficiently detailed report when practicable, assess severity, preserve relevant evidence, restrict access where needed, and work toward proportionate remediation. We may ask for clarification or coordinate a disclosure date. No bug bounty, payment, employment, or reward is promised by this policy.
Authorisation and legal limits
This policy provides a reporting channel and rules for good-faith research; it is not blanket permission to test, access data, bypass authentication, or violate law or third-party terms. Activities outside these rules may be investigated or reported. Researchers remain responsible for complying with applicable law.
Operational security
Delvierre uses role-based access, email verification, restricted file routes, password hashing, session expiry, rate limiting, audit events, secure headers, and Cloudflare-hosted database and object storage. Security is an ongoing process, not a claim that compromise is impossible. Administrators must protect Cloudflare and email-provider accounts with multi-factor authentication and least-privilege credentials.
Personal-data incidents
Reports involving personal data are handled under the Privacy Notice and applicable breach-assessment and notification duties. Do not notify affected users or publish personal data yourself.
Machine-readable contact
A machine-readable security contact is available at /.well-known/security.txt.