Security
How to report a security problem in Skribly, what is in scope, and what to leave out when you test.
Published:
Report a problem
If you find a security problem in a Skribly site, app, package or code repository, write to contact@skribly.pl, in English or Polish. Say what is affected, how to repeat the problem and what an attacker could do with it. A short, careful proof is enough.
Please keep the problem private until it is fixed, or until you and Skribly have agreed on a date to publish it.
The same contact is published in the standard form of RFC 9116 at /.well-known/security.txt.
Skribly has no encryption key for reports yet. If the details are sensitive, send a first short message without them and ask for another way to share them.
In scope
- Every site under skribly.pl, such as skribly.pl, docs.skribly.pl, ui.skribly.pl and this site, trust.skribly.pl.
- The Skribly apps, packages and tools, and their code repositories.
Out of scope
- Services that Skribly uses but does not run, such as GitHub, OVH and Discord. Report their problems to them.
- Denial of service, load tests and automated scans that send many requests.
- Social engineering of the co-authors or of anyone else, and physical attacks.
When you test
- Use only your own accounts and data. Do not open, change or delete other people's data.
- Do not slow down or interrupt a service.
- Stop as soon as you have shown the problem, and write to us.
What to expect
Mail sent to this address reaches a Skribly co-author. There is no fixed time for an answer yet, and Skribly has no bug bounty programme: it pays no rewards for reports.