security policy

reporting a vulnerability

If you've found a security issue affecting boredtype — anything that touches account safety, data exposure, or the integrity of the site — email boredtype@outlook.com directly rather than opening a public issue. We'll acknowledge real reports and work with you on a fix before any public disclosure.

For ordinary bugs that aren't security issues — a broken theme, a miscounted stat, a UI glitch — please use the GitHub repo instead, so we can track it alongside everything else.

what to include

The faster we can reproduce an issue, the faster we can fix it. A good report includes:

• A clear description of the vulnerability
• Steps to reproduce it, or a proof of concept
• What it would let an attacker actually do
• Screenshots or a screen recording, if that helps make it concrete

ground rules while testing

We're happy to have people look for real issues. While doing so, please don't:

• Access, modify, or delete data that isn't yours — a proof of concept should stop at demonstrating access is possible, not actually reading other users' data;
• Run anything that could degrade the site for other people — load testing, automated scanning at volume, or anything resembling a denial-of-service attempt;
• Use social engineering against us or our users;
• Publicly disclose a vulnerability before we've had a reasonable chance to fix it.

Reports that follow these guidelines and describe a genuine impact on boredtype's users or data are always welcome, and we won't pursue action against good-faith researchers who stick to them.

what we actually run

For context, in case it's useful to a report: boredtype is a static HTML/CSS/JS front end with no build step, backed by Supabase (Postgres with row-level security) for accounts, results, and the leaderboard, and by a small set of Netlify serverless functions for Stripe checkout. There's no analytics or third-party tracking script running on the site.

contact

Security reports: boredtype@outlook.com. Everything else: the about page has our other contact links.