# Security policy — tharakamahabage.dev

> Coordinated vulnerability disclosure policy, scope, contacts, and timelines.

## Quick reference

- security.txt: https://tharakamahabage.dev/.well-known/security.txt
                https://tharakamahabage.dev/security.txt
- Primary contact: security@tharakamahabage.dev
- Fallback contact: hello@tharakamahabage.dev
- PGP key: https://tharakamahabage.dev/.well-known/pgp-key.txt
- Preferred languages: en, si
- Subject prefix: [SECURITY] (or [SECURITY-URGENT] for active exploitation)

## Scope

In scope:

- The web property at tharakamahabage.dev and any subdomains listed in DNS.
- Static assets and agent-facing files (HTML, CSS, JS, `llms.txt`, `agent.json`,
  `feed.xml`, `sitemap.xml`, `security.txt`).
- The publishing and deployment workflow visible from public artefacts.

Out of scope:

- Findings requiring physical access, social engineering, or compromise of
  third-party platforms (LinkedIn, GitHub, YouTube).
- Volumetric or denial-of-service findings without a concrete impact.
- Best-practice observations without a demonstrated security impact.
- Third-party infrastructure (upstream host, CDN, analytics).

## Reporting process

1. Email `security@tharakamahabage.dev` with subject prefix `[SECURITY]`.
2. Include a high-level description; defer exploit details to an
   authenticated channel.
3. Where possible, include reproduction steps, affected URLs, and impact.
4. Encrypt sensitive content to the PGP key at
   <https://tharakamahabage.dev/.well-known/pgp-key.txt>.

## Response timelines

- Acknowledgement: within 72 hours.
- Triage and initial assessment: within 7 days.
- Coordinated public disclosure: up to 90 days, or earlier on fix landing.

For severe impact or active exploitation, use the subject prefix
`[SECURITY-URGENT]`. Accelerated handling is expected.

## Safe harbour

Good-faith research within the scope above will not result in legal action
or law-enforcement referral, provided the researcher does not:

- Access, modify, or destroy data not belonging to them.
- Degrade service availability for other users.
- Pivot beyond the in-scope surfaces.
- Publicly disclose findings prior to coordinated agreement.

This statement is offered in good faith and is not a contract.

## PGP fingerprint

The OpenPGP public key for `hello@tharakamahabage.dev` is published at
<https://tharakamahabage.dev/.well-known/pgp-key.txt>. Verify the fingerprint
out-of-band before trusting the key.

```
Tharaka Mahabage <hello@tharakamahabage.dev>
ed25519, expires 2028-05-26

F392 95E7 EF00 923E 2607
40ED D833 060E 6E8D 9EC6
```

The `security.txt` file is clear-signed with this key. Verify with:

```
curl -sO https://tharakamahabage.dev/.well-known/pgp-key.txt
gpg --import pgp-key.txt
curl -s https://tharakamahabage.dev/.well-known/security.txt | gpg --verify
```

## Recognition

Researchers who follow this policy are credited (with permission) on the
human-readable security page after the issue is resolved.

---

Canonical HTML: https://tharakamahabage.dev/security/
Canonical Markdown: https://tharakamahabage.dev/security/index.md