Security

Reporting

Email editors@hr.cafe with “security” in the subject. The same address is published at /.well-known/security.txt in the RFC 9116 format.

Please include what you found, how to reproduce it, and what an attacker could reach. A single request that demonstrates the issue is ideal.

What we promise

• Acknowledgment within three working days.
• An honest assessment, including when we disagree that something is a vulnerability.
• Credit if you want it, and none if you do not.
• Safe harbour. We will not pursue or support legal action over good-faith research that follows this page.
• Disclosure of anything that affected user data, to the people affected, even when it is embarrassing.

There is no bug bounty. The publication is unfunded, and offering money it does not have would be a worse promise than offering none.

In scope

• The site at https://hr.cafe and its form endpoints under /submit/.
• The editorial surface at /admin.
• Anything exposing submissions, responses or subscriber addresses.

Out of scope

• Findings from automated scanners with no demonstrated impact.
• Missing hardening headers with no exploitable consequence.
• Denial of service, volumetric testing, or anything degrading the site for others.
• Social engineering of contributors or editors.

Please do not

Access, modify or download anyone else’s data. If a proof of concept requires it, stop and describe what you could have reached — that is enough.