Security and responsible disclosure

Reporting a vulnerability#

Send your report to kaperx.ma@gmail.com. The same contact details are published in the machine-readable file /.well-known/security.txt at the root of the site, in the standard format designed for this purpose.

You may write in English, French or Arabic. Please do not use the contact form or WhatsApp for security reports: they are not designed for sensitive information.

What to include#

A precise report helps us reproduce the problem and fix it faster:

• the exact address of the page or resource affected;
• the type of vulnerability and its possible impact;
• the steps to reproduce it, with any useful requests or screenshots;
• when you found it, and the browser or tool you used;
• how you would like us to contact you, and whether you would like to be thanked by name once it is fixed.

Do not include personal data belonging to others that you may have seen. If you saw any, simply tell us so, without copying it.

Our commitments#

When you report a vulnerability in good faith:

1. We acknowledge receipt within two working days.
2. We assess the report and tell you whether we can confirm it, and what happens next.
3. We keep you informed of progress until the issue is fixed.
4. We take no legal action against good-faith research that follows the rules on this page. This commitment binds us alone: it cannot bind third parties, such as the site's hosting provider or the authorities.
5. We credit you, if you wish, once the issue is fixed.

Rules for researchers#

To keep your research in good faith:

• No access to other people's data. Do not access, change or delete data that is not yours. Stop as soon as you have demonstrated the problem.
• No harm to availability. No denial-of-service testing, no excessive load, no bulk submissions through the form.
• No social engineering. Do not target our team, our suppliers or our visitors, whether by email, by phone or in person.
• No physical intrusion, and no attacks on our suppliers' infrastructure.
• No early public disclosure. Publish nothing until the issue is fixed or, failing that, until 90 days after your report, unless we agree otherwise.

No bug bounty#

KaperX does not run a bug bounty programme and does not pay for reports. We are glad to thank researchers who wish to be named, once the fix is in place.

How the site protects visitors#

The measures below describe how the site is configured; they are neither a certification nor the result of an audit.

• Encrypted connection. The site is served over HTTPS only. The HSTS header tells your browser to always use an encrypted connection.
• Strict Content Security Policy. A Content Security Policy limits the resources your browser will load and run, which reduces the risk of script injection.
• No advertising cookies. The site sets no advertising cookies and no social media trackers. Details are in our cookie policy.
• Cookieless audience measurement. We use Plausible Analytics, a cookieless audience measurement tool. Its requests go through our own domain: your browser does not contact a third-party service directly for this measurement.
• A minimal contact form. It asks only for the information we need to reply to you, and it is protected against abuse by limiting the number of submissions.
• Updates and rebuilds. The site is generated from a version-controlled code repository, so it can be rebuilt identically; its dependencies are updated with new releases.

If you think your data is affected#

If your report involves personal data, or if you think your own data has been exposed, please also write to kaperx.ma@gmail.com. How we handle your data is described in our privacy policy.