Security and vulnerability reporting

How to report

Email info@phatdev.net with a subject that starts with [security]. Vietnamese or English are both fine.

• The page or component that is affected.
• Steps to reproduce, as specific as you can (a screenshot or a request sample helps).
• The impact you observed.
• How I can reach you.

Scope

In scope:

• The phatdev.net website, including its public APIs and the MCP endpoint.
• Plugins and themes I write and release through phatdev.net (for example SL Migrations).

Out of scope

• Websites of clients and third parties, even when they run my plugins. Report plugin bugs here, and please do not test on someone else's live site.
• Denial of service, spam, social engineering, physical attacks, high-volume automated scanning.

Testing rules

• Use only your own accounts and data.
• Do not access, change or delete other people's data; if you run into sensitive data, stop and tell me right away.
• Do not disrupt the service.
• Give me time to fix the issue before you publish it.

What to expect

I will try to reply within a few working days, keep you updated and tell you when the issue is fixed. This is a personal site, so I do not commit to a specific response time (no SLA). If you would like to be credited once the issue is fixed, say so in your report.

Rewards

There is no bug bounty program and no payment for reports.