Security and responsible disclosure

How this website is protected

• All traffic is served over HTTPS with HTTP Strict Transport Security.
• Responses carry security headers that restrict framing, content sniffing and browser features.
• The contact form validates every field on the server, limits repeated submissions and rejects oversized requests.
• We collect only the data described in our privacy notice, and the site uses no third-party scripts or trackers.

Reporting a vulnerability

Email hello@mbd.agency with the subject "Security report". Please include the affected URL, what you found and the steps to reproduce it. We will acknowledge your report and keep you updated while we fix it.

Please

• Give us reasonable time to fix the issue before telling anyone else.
• Only test against your own data, and stop as soon as you have confirmed the issue.
• Do not run denial-of-service tests, send spam through the contact form or use social engineering.

We do not run a paid bug bounty at the moment, but we are glad to credit researchers who report issues responsibly.

Machine-readable contact details are published at /.well-known/security.txt.