Security and responsible disclosure
If you've found a security problem on shrinkiatry.com, we want to hear about it. Here's how to report it and what you can expect from us.
How to report a problem
Email security@shrinkiatry.com. Tell us the page or address involved, what you found, the steps that reproduce it, and what you think the impact is. Screenshots or a short proof of concept help. Please don't include anyone else's personal data in the report.
We read every report ourselves. We'll acknowledge it within seven days, tell you whether we can reproduce it, and let you know when it's fixed. If you'd like credit, say so and we'll thank you by name on this page once the fix is live.
What's in scope
This policy covers shrinkiatry.com and the pages, files, and forms served from it. The site is static, prerendered HTML hosted on Cloudflare Pages. It has no user accounts and no logins, and it doesn't store patient information. Our forms send what you type to our email through FormSubmit, a third-party form service. Analytics run through Google Analytics 4 and only after a visitor accepts the consent banner.
Useful findings include things like a page that can be made to run someone else's script, a form that leaks what people submit, a misconfigured header that weakens the site's protections, or a file that shouldn't be public.
What's out of scope
Please don't test with denial-of-service or high-volume automated traffic, social engineering, or physical attacks. Problems in services we use but don't run, such as Cloudflare, FormSubmit, or Google, belong with those companies directly. Reports that only list missing best-practice headers without a real impact are welcome, but we'll treat them as improvements rather than vulnerabilities.
Good-faith research
If you act in good faith, stay within this policy, avoid harming the site or its visitors, and give us a reasonable chance to fix a problem before you talk about it publicly, we'll treat your report as the help it is and won't pursue action against you for it. We don't run a paid bug bounty.
Related
The machine-readable version of this contact is at /.well-known/security.txt. For privacy questions, see our privacy policy. For everything else, the contact page lists the right address. You can also verify who runs this site.