# Reporting a security hole: person.tools

# Reporting a security hole

For person.tools and the Ahoy Protocol's reference software.



## How to tell us

- **Write to us through the form at `/security`** on any of our hosts, or `POST /v1/security-reports` on the API with
  JSON `{"what": "...", "how_to_reproduce": "...", "reply_to": "optional: an address you choose to give"}`. No key is
  needed. The report goes into our own database and nowhere else (our data policy).
- An email address will be added here when the domain's mail is set up. Until then the form is the way in.

**We answer within 72 hours** with what we found and what we will do. Until a named person handles reports, they are read by the operator, at least once a day.

## What is welcome

Good-faith research inside these limits is welcome, and we will not pursue anyone who keeps to them:
- Use the simulated mode: no key, or a `test_` key from `POST /v1/keys`. Never try to reach a real person.
- Stop the moment you see any real person's data (an answer, a recording, a receipt that is not yours), tell us, and keep
  nothing.
- No load or denial-of-service testing, no social engineering of anyone, no attempts on Cloudflare itself or on any other
  site served from the same account.
- Probes only at our own hosts: person.tools and its subdomains, and `askpeople-*.pages.dev`.

## What we do with a report

1. Read it the same day where we can, and within 72 hours always.
2. Rate it: can it reach a real person, their data, money, or the signing key? Those are fixed first and may switch
   ringing off while we fix them.
3. Fix it, check the fix on the live service, and tell you. With your permission we name you in the release notes.
4. Publish what happened once it is fixed, without anyone's personal data.

There is no bounty: the service handles no real money yet.

## Our own checks

- Our own attack on the live service, regularly, inside the limits above.
- Before the code is published, a read of the router and the runner for security holes by a reviewer who did not write
  them, with everything it finds fixed first.
- Receipts are signed with Ed25519 keys published at the discovery file's `jwks_uri`, each with a `kid`, so a key can be
  rotated and an old one revoked without breaking the receipts it signed.


Report: POST https://api.person.tools/v1/security-reports or the form at /security.