Security policy and vulnerability disclosure

Send your report by e-mail. Encrypt it with our public PGP key whenever it contains technical details or a proof of concept.

Contact

[email protected]

Public PGP key

/.well-known/pgp-key.txt

Fingerprint

3C11 0D26 D95B A699 3DA0 FEF4 E8C7 6A2C 9D88 DB15

Key ID

E8C76A2C9D88DB15

Algorithm

RSA 4096

Validity

2026-10-07 → 2028-10-06

security.txt

/.well-known/security.txt (RFC 9116, signed)

Import the key, check that the fingerprint displayed by your tool matches the one on this page, then encrypt your report for the recipient below. Do not trust a key whose fingerprint differs.

curl -O https://dqmj1.wiki/.well-known/pgp-key.txt
gpg --import pgp-key.txt
gpg --fingerprint [email protected]
gpg --armor --encrypt --recipient [email protected] report.txt

Attach or paste the resulting report.txt.asc into your message, and include your own public key so that we can reply encrypted. We answer from the same address.

• The affected URL, endpoint or component.
• A description of the vulnerability and its potential impact.
• Clear steps to reproduce it, with a minimal proof of concept.
• Your name or handle if you wish to be credited (optional).

In scope

• The website dqmj1.wiki and the subdomains we operate.
• The public REST API under /api/v1 and the embeddable widgets under /embed.
• The open-source code published on GitHub by this project.

Out of scope

• Denial of service, load or stress testing, and automated scanning at high volume.
• Social engineering, phishing and physical attacks.
• Vulnerabilities in third-party services we rely on (Cloudflare, Resend, Google, GitHub): report them to the vendor.
• Missing best-practice headers or settings without a demonstrated security impact.
• Unvalidated output from automated scanners.

Copyright or trademark concerns are not security matters: write to [email protected] instead.

• We acknowledge your report within 5 business days.
• We give you an initial assessment within 10 business days and keep you informed of the progress.
• We fix confirmed vulnerabilities as quickly as their severity requires.
• We ask for coordinated disclosure: please allow up to 90 days from your report, or until a fix is released, before any public disclosure.
• We credit you in the acknowledgments below unless you prefer to stay anonymous.

We consider security research carried out in good faith and in accordance with this policy to be authorized, and we will not take legal action against researchers who:

• make a good-faith effort to avoid privacy violations, data destruction and service interruption;
• stop testing and report immediately if they reach non-public data;
• do not exploit a vulnerability beyond what is needed to demonstrate it;
• keep the details confidential until a fix is released or the disclosure period ends.

This policy does not authorize testing of third-party services, and it is not a legal waiver of the rights of those third parties.

This is a free, non-commercial project: we do not run a bug bounty. Valid reports are credited publicly, with your consent.

The website has no user accounts, no login and no form that stores personal data. The REST API is public and read-only. The site is served through Cloudflare over HTTPS and refuses to be embedded in frames outside the /embed widgets.

No vulnerability report has been received yet. Thank you to everyone who helps keep this project safe.