Security
If you have found a vulnerability, please tell us at info@attractor.fi. Please do not open a public issue before we have had a chance to fix it.
What we commit to
- We acknowledge reports within two working days and tell you what we intend to do.
- We will not take legal action against good-faith research that follows the boundaries below.
- We will credit you when we fix it, unless you would rather we did not.
What helps
A URL or request that reproduces it, what you expected, what happened, and anything that helps us tell a real finding from a scanner’s enthusiasm. If you can show impact, show it on your own data.
Boundaries
Please do not, while testing:
- run automated scanners against the public site at a rate that degrades it for anyone else, or attempt denial of service;
- access, modify or delete data belonging to anybody else, or move beyond the minimum needed to demonstrate the problem;
- use social engineering, phishing or physical attacks against us or our suppliers.
Particularly interesting to us
Our crawler consumes hostile input by definition, so we care most about the parts that touch it:
- server-side request forgery, DNS rebinding, or any way to make the crawler connect somewhere it should refuse;
- resource exhaustion through crafted responses — oversized bodies, decompression bombs, pathological markup;
- anything that lets a crawled page influence our behaviour rather than merely be recorded as data;
- injection, cross-site scripting, or an open redirect in the click-out.
- Account/session compromise, cross-account access to adverts or photos, replayed sign-in codes, login CSRF, or unsafe uploaded content.
Out of scope
Reports whose only content is output from an automated scanner with no demonstrated impact, best-practice advice about our TLS configuration without an attack, or issues in third-party sites we merely link to.
Privacy issues
Concerns about what we collect belong on the privacy page; requests to remove crawled content go through the process on the crawler page.