Security policy

Reporting

Send reports to security@unsolicitedoutreach.com. Include the URL, the steps to reproduce, and what you observed. A plain email is fine; we do not require a template. This address and the rest of this policy are also published at /.well-known/security.txt.

We acknowledge reports within a few business days and tell you what we found when we have looked.

In scope

• The website at unsolicitedoutreach.com and its API routes.
• The contact and removal forms, including the DNS verification step.
• Any way to publish, alter, or remove a record without going through review.
• Any exposure of unpublished data, such as recipient addresses.

Out of scope

• Third-party services we use (hosting, DNS, mail delivery, the anti-abuse widget). Report those to the provider.
• Rate-limit findings that require sustained high-volume traffic.
• Reports generated by automated scanners with no demonstrated impact.
• Social engineering of the people who run the site.

Please do not

Do not access, modify, or delete data that is not yours. Do not run denial-of-service tests. Do not attempt to verify control of a domain you do not control. Stop and report as soon as you have enough to demonstrate the issue.

On bounties

We do not run a bug bounty program and we do not pay for reports. Please do not ask for payment before disclosing an issue, and please do not send “I found a vulnerability, pay me to learn more” messages. We will credit you here if you want, once the issue is fixed.