WebReviewThis is a small, hand-written site rather than a content management system, so the usual plugin and admin-panel attack surface does not exist. If you have found something that looks wrong, the address below reaches a person.
Reporting a vulnerability
Email security@webreviewstar.com. Encrypted mail is welcome but not required.
Useful in a report:
- What you did, step by step, so it can be reproduced
- What happened, and what you expected instead
- The URL, and the time with a timezone
- Anything you captured — a request, a response, a screenshot
What to expect
An acknowledgement within five working days. If the report is valid, an indication of when a fix is likely. If it is not, an explanation of why.
Please do not
- Test against other people's data, or attempt to access anything that is not yours
- Run automated scanners that degrade the site for readers
- Publish details before a fix is available — tell us first and we will credit you if you want
No bug bounty
There is no payment for reports. This is a small independent publication, and the honest position is that we cannot offer one. Reports are still read and still welcome, and a credit on this page is offered for anything that leads to a fix.
Scope
Everything served from webreviewstar.com. The hosting infrastructure itself is the provider's responsibility — report issues there to them directly.
Machine-readable
The same information is published at /.well-known/security.txt in the format defined by RFC 9116.