Security policy

Contact

Email benjamin@lucidrail.com with the subject line "Terranoux security". Include a description of the issue and its impact, steps to reproduce or a proof of concept, and the affected URL if known.

In scope

• This website (terranoux.com) and its Vercel deployment
• The source repository as it relates to the site
• The /admin passkey authentication and stored brief intake data

Out of scope

• Social-engineering or physical attacks
• Denial of service
• Findings that require an already-compromised device or account
• Missing security headers on third-party hosts (Plausible, sibling-company sites)

What to expect

Reports are reviewed by Benjamin. There is no bug-bounty program and no SLA. Please allow a reasonable time to fix a confirmed issue before any public discussion.

Safe harbor

Good-faith research that stays within this policy, does not access other people's data, and does not disrupt the site is welcome.