$ responsible_disclosure --start
Security Disclosure
Learn how to report security vulnerabilities affecting Basri Akkaya’s website safely, clearly, and responsibly.
When I build this site, I do not see security as a collection of headers, an audit result, or a green check mark at the end of a build.
To me, security becomes real in what we choose to do when something goes wrong. There is a meaningful difference between quietly abusing a vulnerability and reporting it clearly to the person who can fix it. I believe that difference is responsibility.
If you discover a genuine vulnerability, a misconfiguration, accidentally exposed sensitive information, or another issue that could affect visitors to this site, you are welcome to report it to me.
How to report an issue
You can send your report to real0kage@protonmail.com.
When possible, include the affected URL or component, a concise explanation, the steps required to reproduce the issue, the expected and actual behavior, and a harmless screenshot or proof of concept if one is useful.
Your report does not need to be perfect. It only needs to contain enough clear information for me to understand and investigate the issue.
Research guidelines
Please do not cause service disruption or use high-volume automated scanning, DDoS, social engineering, or phishing. Do not attempt to access another person’s data. Do not download, modify, retain, or share personal or sensitive information you encounter.
Once an issue is confirmed, do not go beyond what is necessary to demonstrate it. If you accidentally encounter sensitive information, stop testing and report the issue while retaining as little of that information as possible.
Please allow a reasonable amount of time for remediation before making the issue public.
What happens after a report?
When I receive a report, I will first try to understand and reproduce the issue. If it is a genuine security problem, I will assess its impact and prepare a safe fix.
I cannot promise that every report will be resolved on the same day. I do take good-faith, clearly written reports seriously, and I will try to communicate openly about the process.
If the report is valid and you would like to be credited, I may acknowledge your contribution by name or by your preferred handle after the issue has been resolved. If you prefer to remain anonymous, simply mention that in your report.
Good-faith research
My approach toward researchers who follow this policy, avoid harm to visitor data, and remain within the minimum steps needed to verify an issue is to understand and remediate the problem—not to punish the person who reported it.
This policy is not unlimited authorization to test. If you are unsure whether a method is appropriate, contacting me before using it is the safest option.
Final note
Keeping the internet a little safer often begins with someone choosing not to ignore a problem they noticed.
If you find something, please do not hesitate to let me know.
$ security_report --send responsibly
Cybersecurity is not a hobby; it is a responsibility.