Report an issue
If you think you have found a security vulnerability in this website, email admin@eprojac.com with a subject line starting “Security”. Please include:
- the page, URL or endpoint affected;
- what the issue is, and what an attacker could do with it;
- steps to reproduce it, with any proof-of-concept code, requests or screenshots; and
- how we can contact you.
The same contact details are published in /.well-known/security.txt. We read every report, but we do not promise a response time. For questions about your personal data, use Data requests instead.
Scope
This policy covers eprojac.com and www.eprojac.com, including the feedback endpoint /api/feedback.
It does not cover:
- our products, which have their own security pages: Local pDigger and SeeCodes (you can also email security@seecodes.com);
- other sites, including pdigger.com and sla.eprojac.com. The commitment below does not extend to testing them, but if you notice a problem there, tell us at admin@eprojac.com; or
- the platforms of our providers, such as AWS and Google. Report issues in those directly to the provider.
Please send findings with a demonstrated security impact rather than raw scanner output.
Rules for good-faith research
We will not take legal action against good-faith security research on this website that follows these rules:
- Do not run denial-of-service or load tests, or do anything else that degrades the website for other people.
- Do not use social engineering, phishing or physical attacks.
- Send no more than a few test messages through the feedback form, and mark them clearly as tests, for example with “[TEST]” in the message.
- Do not access, change, delete or keep other people’s data. If you come across personal data, stop, do not keep it, and tell us.
- Stop as soon as you have shown that the issue exists, and do not use it to reach other systems.
- Give us reasonable time to fix the issue before you publish anything about it, and coordinate disclosure with us.
- Follow the law.
If you are unsure whether something is allowed, ask us first at admin@eprojac.com. We cannot give permission to test systems that belong to others, including our providers.
No bug bounty
We do not run a bug bounty programme and do not pay for reports. We are still grateful for them.
How the website is built
The website is designed to leave little room for things to go wrong. This section describes how it is built; it is not a guarantee.
- Static pages. Every page is a pre-built file served by Amazon CloudFront from a private Amazon S3 bucket. There are no user accounts, no logins and no server-rendered pages.
- HTTPS only. Connections use TLS 1.2 or higher, and browsers are told to use HTTPS for future visits (HSTS).
- Strict Content Security Policy. Pages may load scripts, styles, fonts and data only from eprojac.com. Inline scripts and styles are not allowed, and other sites cannot show our pages in a frame.
- No cookies and no third-party requests. Nothing is loaded from any other website.
- One small function behind the form. The feedback form is handled by a single AWS Lambda function. It can be reached only through CloudFront, which signs each request; direct calls to the function are rejected. It accepts only small JSON requests (up to 8 KiB), checks that they come from our own website, and validates every field.
- Least privilege. The function can only write its own logs, read and write its own database table, and send email from feedback@eprojac.com to our own mailbox, admin@eprojac.com. The form cannot be used to send email to anyone else.
- Rate limits and spam checks. Each network can send 5 messages an hour, and the form accepts 100 a day in total. Hidden checks discard automated submissions.
- Minimal logs. Operational logs record only technical details, such as a request ID, the status and timing. They never include message content, headers or IP addresses, and are kept for 14 days.
- Encryption at rest. Data stored in AWS is encrypted at rest.
We do not claim any security certification for this website. Its infrastructure runs in AWS us-east-1. Retention periods are listed in the Privacy notice.