If you find a security problem with plottypus.com, email hello@plottypus.com with the details and the steps to reproduce it. Please do not post it publicly first.
What counts
- A way to read someone else’s account, form answers or email address.
- A way to sign in as someone else.
- A way to mark a payment as made without paying, or to pay less than the price shown.
- A way to make the site run code it should not, or to send mail as plottypus.
- A way around the form’s spam checks at scale.
What happens next
A person reads every report and replies by hand. Once the problem is fixed, we are glad to credit you here if you want.
Out of scope
- Reports from automated scanners without a working example.
- Missing security headers that do not lead to a real problem.
The machine-readable contact is at /.well-known/security.txt.