Vulnerability Disclosure Policy

• In scope: the origin https://secret.alexjungean.com, including create, reveal, and the documented APIs.
• Out of scope: denial-of-service, physical attacks, social engineering of the Operator or of third-party staff, attacks on Netlify or Supabase as platforms, and research that consumes or attempts to decrypt other people’s live envelopes.
• The portfolio site https://alexjungean.com is a different origin and is not this Service.

• Use your own test secrets. Never Reveal a link you do not own.
• Do not exfiltrate live rows, HMAC material, or other users’ ciphertext.
• Do not publicly post a working exploit, a stolen envelope, or a capability link.
• Stay within rate limits where possible. If you must demonstrate a limit bypass, use the minimum number of requests and stop.
• Do not demand payment under threat of disclosure.

Email alex.jungean@gmail.com with subject “Security — One Time Secret”. Preferred language: English. Include a high-level description, the affected route template (for example the create API or the reveal page), impact, and steps that do not embed live capability values. Do not send plaintext of other people, raw proofs, AES keys, or full capability URLs.

We aim to acknowledge a clearly written report within 72 hours. That is a target, not a contractual SLA. We may ask for clarification. We will tell you when a fix is live if you left a contact.

If you act in good faith, stay in scope, do not harm users, and do not access data that is not yours, the Operator will not pursue a civil claim against you for that research and will not refer you for prosecution for that research alone. This is not immunity from law and does not bind public prosecutors. It does not authorise crime.

• At-most-once release and response-loss consuming a secret — this is the documented product.
• A person with the complete capability link being able to Reveal once — this is the documented product.
• The Operator storing ciphertext — this is the documented product.
• Generic API bodies that do not distinguish wrong proof, expiry, and replay — this is intentional.
• Absence of accounts, email, or a “revoke” button other than self-Reveal.