---
date: '2025-02-21'
description: How I handle and communicate security issues for aarnphm.xyz and related services
id: security policy
layout: technical
modified: 2026-06-05 15:07:56 GMT-04:00
noindex: true
permalinks:
  - /security
tags:
  - evergreen
title: Security Policy
created: '2025-02-21'
published: '2025-02-21'
pageLayout: technical
slug: security-policy
permalink: https://aarnphm.xyz/security-policy.md
generator:
  quartz: v4.6.0
  hostedProvider: Cloudflare
  baseUrl: aarnphm.xyz
full: https://aarnphm.xyz/llms-full.txt
---
**Effective date**: February 21, 2025

_Last updated_: February 21, 2025

### Scope

This policy applies to `https://aarnphm.xyz` and subdomains, static content, and any code/services deployed from this repository (including Workers/Edge functions). It complements the [[privacy policy|Privacy Policy]] and [[terms of service|Terms of Service]].

Out of scope (report to the vendor directly): Cloudflare platform issues, Plausible Analytics, Stripe, GitHub, browser/vendor vulnerabilities.

### Reporting security issues

Please report issues privately and avoid public disclosure until a fix is available.

- Email: [security\[at\]aarnphm.xyz](mailto:security@aarnphm.xyz) with the subject `SECURITY`
- Optional: Private GitHub [advisory](https://github.com/aarnphm/aarnphm.github.io/security/advisories/new)

Include clear reproduction steps, affected URL/component, potential impact, and any mitigations. Please do not include sensitive personal data in reports.

Acknowledgement target: within 72 hours. Status update target: within 7 days.

### Issue triage

I will validate the report, determine severity and scope, identify affected versions/deployments, prepare a fix/mitigation, and coordinate a timeline for release and disclosure. If a third‑party vendor is involved (e.g., Cloudflare), I will coordinate with them.

### Threat model

Assumptions: this is a personal site with limited data collection (see [[privacy policy|Privacy Policy]]). Primary risks include supply-chain vulnerabilities, XSS from user-generated comments or third-party embeds, misconfigured headers or CSP, token and secret exposure in Workers, SSRF to cloud metadata, OAuth failures, authorization bypass, and denial of service. GitHub OAuth is used for comment identity and protected MCP authorization flows.

### Issue severity

Severity reflects likelihood and impact (inspired by CVSS). Ranges are indicative.

#### CRITICAL (CVSS $\geq 9.0$)

Remote code execution, secret/key exfiltration, domain/account takeover, or full compromise of confidentiality, integrity, or availability without special conditions.

#### HIGH (CVSS $7.0$ to $8.9$)

Serious impact requiring certain conditions or privileges, e.g., XSS enabling persistent content injection, SSRF reaching sensitive metadata, privilege escalation in operational tooling, or significant data loss.

#### MODERATE (CVSS $4.0$ to $6.9$)

Denial of service, reflected XSS with limited impact, open redirect enabling phishing, or vulnerabilities with meaningful but contained blast radius.

#### LOW (CVSS $< 4.0$)

Informational issues or low‑risk weaknesses such as overly permissive headers with no practical exploit, minor CSP gaps, or verbose error messages.

### Prenotification policy

For CRITICAL, HIGH, or select MODERATE issues, I may privately notify affected vendors or partners (e.g., Cloudflare, Plausible, Stripe) shortly before release to enable coordinated fixes.

- Notification is via private email and/or adding vendor contacts to a private advisory a few days before release.
- Requests to join a notification list can be emailed to [security\[at\]aarnphm.xyz](mailto:security@aarnphm.xyz) and will be considered case‑by‑case.
- Organizations may be removed for premature disclosure before fixes are public.

### Responsible disclosure and safe harbor

If you follow this policy and make a good‑faith effort to avoid privacy violations, service disruption, or data destruction, I will not initiate legal action. Do not run automated DDoS, spam, or social engineering. Coordinate timelines; public disclosure is preferred after a fix is deployed or within a mutually agreed window.

### Operational practices

- HTTPS, HSTS, and standard transport security are enforced by default
- Least‑privilege secrets management and periodic key rotation
- Regular dependency updates and supply‑chain monitoring
- Minimal analytics and logging; see [[privacy policy|Privacy Policy]]
- CSP and security headers reviewed periodically

### Changes

This policy may change over time. Updates will be posted here with a new date.

### Contact

Questions or reports: [security\[at\]aarnphm.xyz](mailto:security@aarnphm.xyz)