Reporting a security hole

Tell us through the form below or the API. We answer within 72 hours.

A preview. Simulated people for everyone. Real calls by invitation. No money is charged: every amount is test money.

For person.tools and the Ahoy Protocol's reference software.

How to tell us

• Write to us through the form at /security on any of our hosts, or POST /v1/security-reports on the API with JSON {"what": "...", "how_to_reproduce": "...", "reply_to": "optional: an address you choose to give"}. No key is needed. The report goes into our own database and nowhere else (our data policy).
• An email address will be added here when the domain's mail is set up. Until then the form is the way in.

We answer within 72 hours with what we found and what we will do. Until a named person handles reports, they are read by the operator, at least once a day.

What is welcome

Good-faith research inside these limits is welcome, and we will not pursue anyone who keeps to them:

• Use the simulated mode: no key, or a test_ key from POST /v1/keys. Never try to reach a real person.
• Stop the moment you see any real person's data (an answer, a recording, a receipt that is not yours), tell us, and keep nothing.
• No load or denial-of-service testing, no social engineering of anyone, no attempts on Cloudflare itself or on any other site served from the same account.
• Probes only at our own hosts: person.tools and its subdomains, and askpeople-*.pages.dev.

What we do with a report

1. Read it the same day where we can, and within 72 hours always.
2. Rate it: can it reach a real person, their data, money, or the signing key? Those are fixed first and may switch ringing off while we fix them.
3. Fix it, check the fix on the live service, and tell you. With your permission we name you in the release notes.
4. Publish what happened once it is fixed, without anyone's personal data.

There is no bounty: the service handles no real money yet.

Our own checks

• Our own attack on the live service, regularly, inside the limits above.
• Before the code is published, a read of the router and the runner for security holes by a reviewer who did not write them, with everything it finds fixed first.
• Receipts are signed with Ed25519 keys published at the discovery file's jwks_uri, each with a kid, so a key can be rotated and an old one revoked without breaking the receipts it signed.

Report a hole