Skip to content
Noorad

Security

Reporting a vulnerability

This page covers the noorad.us website only. If you are a client with a security concern about an engagement, contact your engagement lead directly.

How to report

Email security@noorad.us, or hello@noorad.us if that bounces. Include the URL, what you did, what happened, and anything we need to reproduce it. Our machine-readable contact details are published at /.well-known/security.txt.

We aim to acknowledge reports within five business days.

No bounty

We do not operate a bug bounty and do not offer payment for reports. We are glad to credit you by name once an issue is resolved, if you want that.

Safe harbour for good-faith research

If you make a good-faith effort to follow this policy while researching a vulnerability here, we will not pursue or support legal action against you for that research, and we will treat it as authorised for the purposes of computer misuse law. Good faith means:

  • Stopping as soon as you have confirmed a vulnerability. Do not pivot, escalate, or go looking for what else is reachable.
  • Not accessing, modifying, or exfiltrating data that is not your own. If you encounter anyone's personal data, stop and tell us.
  • No denial of service, spam, physical attacks, social engineering of our people or suppliers, or anything that degrades the service for others.
  • Giving us a reasonable chance to fix the issue before you disclose it publicly.

This is our commitment, not a waiver on behalf of anyone else. It cannot authorise you against Cloudflare or any other third party, and it does not override any law that applies to you.

Scope

In scope: noorad.us and its subdomains. This is a static site with no server-side code, no database, no accounts, and no forms, and it ships no JavaScript of its own — our Content-Security-Policy sets script-src 'none'. So the realistic surface is host configuration, DNS, email authentication, and HTTP response headers.