Vulnerability disclosure.

How to report

Email security@qryptonics.com with enough detail to reproduce: the URL or component, the steps, and what you observed. A short proof of concept is worth more than a scanner export. Machine-readable contact details are at /.well-known/security.txt.

What to expect

• Acknowledgement within five working days
• An assessment and our intended fix within fifteen working days
• Credit in this page's acknowledgements, if you want it
• A straight answer if we decide not to fix something, and why

In scope

• qryptonics.com and everything served from it
• The simulator and the community form
• Our DNS, mail authentication and TLS configuration
• The public source repository

Out of scope

These are known, accepted, and reporting them will get a polite acknowledgement rather than a fix:

• No X-Frame-Options or frame-ancestors. Both require an HTTP response header and our host does not allow custom headers. The site has no authentication and no state-changing actions, so clickjacking has nothing to steal. Documented rather than hidden.
• No HSTS header, for the same reason. HTTPS is enforced and HTTP redirects to it.
• Self-XSS. Text you type into your own form or simulator is your own. It is never stored, never served to anyone else, and the content security policy would block injected script regardless.
• Missing security headers that carry no risk on a static site with no cookies, no sessions and no storage.
• Findings from an automated scanner with no demonstrated impact.
• Social engineering of our staff, and anything involving physical access.

Safe harbour

If you act in good faith under this policy we will not pursue legal action, and we will say so to anyone who asks. Good faith means: stay within scope, do not degrade the service, do not access or modify data that is not yours, stop as soon as you have demonstrated the issue, and give us a reasonable chance to fix it before publishing.

We do not run a paid bug bounty. We are a small company and would rather be honest about that than imply a reward we cannot pay.

How this site is built

Stated plainly, because it saves you time and shows what the attack surface actually is:

• Static HTML, CSS and JavaScript. No backend, no database, no authentication.
• Zero runtime dependencies. Fonts are self-hosted, so the site makes no third-party requests at all.
• A strict content security policy: default-src 'none', scripts pinned to same-origin plus SHA-256 hashes of the two inline blocks.
• Everything you build in the simulator stays in your browser and is never transmitted.
• The source is public, and every change runs through automated checks before it deploys.

Acknowledgements

Nobody yet. This section will list anyone who reports something we fix.