Security and responsible disclosure
If you have found a weakness in this site, we want to hear about it, and we would rather hear it from you first. This page says what is covered, how to tell us, what we ask in return and what you can expect from us. It was last reviewed on .
Scope
This policy covers this website and the public data endpoints it serves. Those are the machine-readable surfaces a person or an agent can fetch without signing in:
- The sites export, the full public record of every site in the directory, as JSON.
- The operations feed, the public status data behind the operations page.
- The search index that powers site search.
- The plain-text index files, llms.txt and llms-full.txt, and the one-site version at
/sites/<slug>/llms.txt, where the slug is the last segment of any site's page in the directory. - The feeds, the collection feed and the latest-across-the-fleet feed.
- The member badges described on the badge page, served as images at
/badge/<slug>.svg.
This policy covers tonvincollection.com only. The other sites in the collection are separate deployments outside this policy, so please do not test them under it. Being listed in the directory does not bring a site within its scope.
How to report
Send an email to security@tonvincollection.com. English is preferred, but if you cannot write it, write in the language you are comfortable with and we will do our best. Please do not use the public contact form for security reports.
A report is easiest to act on when it includes:
- the address of the page or endpoint, and the exact request or steps that show the problem;
- what you expected to happen and what happened instead;
- what you think an attacker could do with it, in your own words;
- any proof-of-concept, kept as small as it can be while still showing the problem;
- how you would like to be credited, if at all.
What we ask
- Collect only what you need to prove the problem exists, and no more. Do not copy, keep or share data in bulk.
- Do not run tests that degrade the site for other people, including floods of requests and anything aimed at taking it offline.
- Do not use social engineering, phishing or any form of pressure against us or anyone else.
- Do not access, change or delete data that belongs to other people. If you reach some by accident, stop and tell us.
- Give us a reasonable time to fix the problem before you publish anything about it, and talk to us first about timing.
What to expect
We will acknowledge your report, tell you whether we can reproduce the problem, and keep you informed while we work on it. We will tell you when it is fixed. We do not run a bounty programme and we do not pay for reports. If you want to be named once the problem is fixed, say so in your report and we will credit you; if you would rather stay anonymous, we will respect that too.
Good-faith research
If you research this site in good faith and follow this policy, we will treat what you send us as a good-faith report and work with you to understand and fix the issue. This is a statement of how we intend to respond, not a legal agreement. If you are unsure whether something is covered, ask before you test.
Machine-readable version
The same contact details are published as a security.txt file, in the standard format that automated tools look for. It names this page as its policy and carries an expiry date, after which it should be treated as out of date. For anything that is not a security matter, use the contact page.