Security

How to report a security problem with this site, and what the site does to keep the surface worth attacking as small as possible.

Reporting a vulnerability

Write to info@yielab.com with enough detail to reproduce the issue: the address, what you did, what happened, and why it matters. A screenshot or a short recording helps. This is a personal site with a single maintainer and no response-time guarantee — expect an acknowledgement within a few days, and please follow up if none arrives.

What is in scope

The public site and the machine-readable surfaces it serves: pages, the sitemap, robots.txt, the RSS feeds and the search index. Anything that lets someone alter what other readers see, reach something the site does not intend to publish, or run code in a reader's browser is worth a report.

What is out of scope

Output from an automated scanner with no demonstrated impact; missing headers or best-practice findings with no working attack behind them; volumetric denial of service and load testing; social engineering; and issues belonging to the hosting provider's own infrastructure, which should go to that provider.

Testing guidelines

Test with your own browser and your own requests. Do not degrade the site for other readers, do not run high-volume automated traffic against it, and do not try to reach anything that is not yours. There are no accounts and no reader data here, so there is nothing to take — please do not go looking for it anyway.

Good-faith research

Research that follows the guidelines above, is reported privately, and allows a reasonable period before disclosure is welcome, and nothing will be pursued over it. There is no bug bounty — this is an unfunded personal project — but credit is offered to anyone who wants it.

How the site is built

There are no accounts, no logins, no comment forms and no database. Pages are pre-rendered from files in a repository, and the editorial tool used to write them is excluded from the public build and refuses to run in it. Responses carry a content security policy, HSTS, nosniff, a deny-framing policy and a restrictive permissions policy. Nothing loads from a third-party origin — fonts and assets come from the site itself — and no analytics or tracking script runs anywhere.

security.txt

The same contact details are published in machine-readable form at /.well-known/security.txt, following RFC 9116.

Contact

Security reports and anything else security-related: info@yielab.com.

Last reviewed: September 2026.