Responsible disclosure is welcome. This page describes the scope, process, and timelines for reporting security issues affecting tharakamahabage.dev and related public surfaces.
The following surfaces are in scope for coordinated disclosure:
- The web property at tharakamahabage.dev and any subdomains explicitly listed in DNS.
- Static assets and metadata served from those origins
(HTML, CSS, JavaScript, agent-facing files such as
llms.txt,agent.json,feed.xml,sitemap.xml,security.txt). - The publishing and deployment workflow visible from public artefacts (cache-control behaviour, content provenance, link integrity).
The following are out of scope:
- Findings that require physical access, social engineering, or compromise of third-party platforms (LinkedIn, GitHub, YouTube).
- Denial-of-service, volumetric, or rate-limit findings unless they demonstrate a concrete confidentiality or integrity impact.
- Best-practice observations without a demonstrated security impact (for example, missing optional security headers on static assets that contain no sensitive data).
- Findings in third-party infrastructure (the upstream hosting provider, CDN, or analytics services). Those should be reported to the respective vendor.
Send an initial report to security@tharakamahabage.dev
with the subject line prefix [SECURITY]. A short headline
and a high-level description is sufficient to begin coordination;
exploit details can follow over an authenticated channel.
Where possible, include:
- A description of the issue and its potential impact.
- Steps to reproduce, or a proof-of-concept that does not affect third parties or the public web.
- Affected URLs, parameters, or files.
- Whether the issue has been disclosed elsewhere.
For sensitive content, encrypt to the PGP key published at /.well-known/pgp-key.txt. The fingerprint will be reproduced below for out-of-band verification.
Indicative response targets, measured from receipt of an actionable report:
- Acknowledgement. Within 72 hours.
- Triage and initial assessment. Within 7 days.
- Coordinated public disclosure. Up to 90 days, or earlier if a fix lands sooner. Extensions are discussed with the reporter where complexity warrants it.
For findings with active exploitation indicators or severe impact,
accelerated handling is expected. Indicate this explicitly in the
subject line: [SECURITY-URGENT].
Good-faith security research conducted within the scope above will not result in legal action or law-enforcement referral. Research must avoid:
- Accessing, modifying, or destroying data that does not belong to the researcher.
- Degrading service availability for other users.
- Pivoting beyond the in-scope surfaces.
- Public disclosure prior to coordinated agreement.
This safe-harbour statement is offered in good faith and is not a contract. It is intended to give researchers reasonable comfort to report findings.
The OpenPGP public key for
hello@tharakamahabage.dev is published at
/.well-known/pgp-key.txt.
Verify the fingerprint out-of-band before trusting the key.
Tharaka Mahabage <hello@tharakamahabage.dev> ed25519, expires 2028-05-26 F392 95E7 EF00 923E 2607 40ED D833 060E 6E8D 9EC6
The security.txt file is clear-signed with this key. Verify with:
curl -sO https://tharakamahabage.dev/.well-known/pgp-key.txt gpg --import pgp-key.txt curl -s https://tharakamahabage.dev/.well-known/security.txt | gpg --verify
Researchers who follow this policy and report issues responsibly are credited (with permission) on this page after the issue is resolved.
No active credits at the time of writing.