Reporting a vulnerability

How to report

If you find a security issue on calimsec.com, email liang.zhong@calimsec.com with the subject “Security report”. Include the affected URL, the steps to reproduce it and the impact you think it has.

To encrypt your report, ask for my PGP key first. The same details are in security.txt.

What you can expect

• An acknowledgement within two working days.
• A fix timeline that matches the severity, shared once I’ve assessed the issue.
• Credit by name once the fix is live, if you want it.

What I ask in return

• Give me a reasonable time to fix the issue before you disclose it publicly.
• Don’t access data beyond what you need to show the issue.
• Don’t degrade the site or run destructive tests.

If you follow this policy in good faith, I won’t take legal action against you for your research on calimsec.com.

Out of scope

Social engineering, denial of service, and services I don’t run myself, such as Cloudflare, Proton or LinkedIn. Please report issues in those services to their own security teams.