Security Policy

Last updated: October 28, 2026

Found a hole in something I run? First, thank you. Second, please tell me before anyone else, so I can fix it. This page explains how, and what you can expect from me.

1. What you can look at

adamspierredavid.com, every subdomain of it, and the servers and services behind them that I run myself.

I also build and host sites for other people. Found something on one of those? Tell me the same way, and I'll fix it or get it to the right person.

2. What to leave alone

A few things aren't worth your time, or would hurt real visitors:

• services run by other companies, like Google Analytics, Microsoft Clarity or my email provider. Tell them directly: they have bigger budgets than me;
• denial of service or load testing. The site runs on modest hardware, and knocking it over proves nothing we don't both already know;
• spamming the contact form. My spam filter has enough work already;
• phishing, social engineering, or anything physical;
• raw scanner output, missing headers, software versions, self-XSS or clickjacking, unless you can show how someone would actually get hurt.

3. How to tell me

Write to my security address. If the details are sensitive, encrypt them with my PGP key. No PGP? No problem: a normal email works, or use the contact form and we'll find another way.

It helps a lot if you include:

• where it is (a URL, or the service);
• how to reproduce it, step by step;
• what someone could do with it;
• the name you'd like me to credit, if any.

English or French, whichever you prefer.

4. Playing nice

While you look around:

• do just enough to show the problem, then tell me;
• keep automated tools gentle, so the site stays up;
• give me time to fix it before you talk about it publicly: until it's fixed, or 90 days, whichever comes first. If I need longer, I'll tell you why and we'll pick a date together.

5. What you can expect from me

• A reply within 5 working days, so you know a human got your message.
• Updates while I work on it, and a message when it's fixed.
• The most serious problems fixed first.
• Your details kept to myself, unless you'd like to be credited.

I'm one person, not a security team, so some fixes take a little time. But I read every report.

6. You're safe here

If you follow this page in good faith, you're helping me, and I'll treat you that way: I consider your research authorised and won't take legal action over it. If anyone else does, I'll confirm that I authorised it.

Not sure whether something is OK? Just ask first.

7. Thanks and credit

I can't pay for reports, but I can say thank you in public. Once the problem is fixed, and if you agree, your name goes in the Security Hall of Fame. It's a small list for now, so you'd stand out.

8. Changes to this policy

If this policy changes, I'll update this page and the date at the top. The same details are also published for machines at /.well-known/security.txt.