ogurexxx open to work
RU EN
← cd ~

ogurexxx@root:~$ cat SECURITY.md

Vulnerability disclosure

Looking for vulnerabilities? Go ahead — this site is meant to be tested. Below: what is in scope, the rules, and how to report. Follow them and there will be no complaints against you.

In scope

  • ogurexxx.ru and www.ogurexxx.ru — the whole site: pages, forms, headers, TLS, the curl text version.
  • The Gopher mirror: gopher://ogurexxx.ru/
  • Domain configuration: DNS, CAA, security.txt, the PGP key.

Out of scope

  • Traps: SSH on port 22, the WordPress login form and addresses hidden from humans. They are honeypots — “breaking into” them is their purpose and does not count as a vulnerability.
  • DoS, flooding and load testing.
  • Social engineering, phishing, physical access.
  • Other ports and services on this IP, and third-party services (GitHub, Telegram, e-mail).
  • Scanner output without a proof of concept, and anything already known and explained on the Audit page (for example, DNSSEC is off — and it says why).

Rules

  • Stop at the proof: do not read, change or keep more data than needed to demonstrate the issue.
  • Do not disrupt other visitors or the site’s availability.
  • No more than a few requests per second. Faster, and the automatic protection bans your address for one to four hours — that is not a bug, that is it working. Need a fast scan? Ask first.
  • Give me time to fix it and do not publish details before that — usually up to 30 days, we can agree.

Safe harbor

If you acted in good faith and within these rules, I consider your research authorized: I will not complain to your ISP, hosting or law enforcement, and will not ask you to remove the finding from your portfolio once it is fixed. Stepped out of scope by accident? Just tell me and we will sort it out.

How to report

  • E-mail: issafianov@edu.hse.ru
  • Telegram: t.me/ogurexxx
  • Include: the URL, steps to reproduce, what it gives an attacker, and a proof (request and response, a screenshot).
  • I will reply within 3 days. Serious issues get fixed as fast as possible, and I will tell you when.

Hall of fame

There are no cash rewards — this is a personal site. But your name goes here (with your consent), along with honest thanks.

$ cat hall-of-fame.txt
# empty so far — you could be the first

Machine-readable contacts are in security.txt (RFC 9116).