Use intended access only
Reports based on normal public browsing or an issue encountered accidentally are welcome. This policy does not authorize probing, exploitation, or access beyond intended public functionality.
SECURITY / RESPONSIBLE REPORTING
See a weak signal?
Report it without widening the harm.
A security report should reduce risk, not create a second incident. This page provides a clear contact path for issues observed on Code Over Chaos while preserving legal, privacy, and safety boundaries.
Policy effective August 14, 2026Scope: codeoverchaos.comNo intrusive testing authorized
EVIDENCE
A reporting address is infrastructure.
The Internet Engineering Task Force published RFC 9116 in April 2022 because security vulnerabilities can remain unreported when organizations lack a clear contact path. It defines a machine-readable security.txt file and explicitly warns that the file does not grant permission to test a system.
CISA's vulnerability disclosure policy template similarly separates reporting instructions, scope, authorized activity, prohibited activity, and handling expectations. Code Over Chaos uses those structural lessons while adopting a narrower boundary: responsible reports are welcome, but this page does not authorize security testing.
BOUNDARIES
Four rules before sending anything.
Protect people and data
Do not access, copy, alter, retain, or disclose another person’s data. Stop immediately if private information, credentials, tokens, or nonpublic systems become visible.
Do not disrupt service
No denial-of-service activity, destructive actions, high-volume automated scanning, spam, social engineering, physical testing, persistence, or attempts to evade monitoring.
Keep third parties outside scope
Hosting providers, email services, source platforms, analytics, dependencies, and linked websites are governed by their own policies and are not authorized targets under this page.
INFERENCE / FRACTAL CHECK
One observation may expose a repeated assumption.
- SYMPTOMRecord the smallest safe observation.
- COMPONENTIdentify the affected boundary without probing farther.
- PATTERNAsk which shared template or dependency may repeat it.
- SYSTEMRepair and verify every authorized instance.
EDITORIAL VIEW
Restraint is part of technical skill.
The strongest report proves only what is necessary to explain the risk, protects the people behind the data, and leaves remediation easier than it found it.
A dramatic demonstration is not automatically a better one. Stop at the first reliable signal, separate observed evidence from inferred impact, and let the authorized owner decide how deeper validation will be performed.
REPORTING PATH
Send a minimal, redacted report.
- The exact Code Over Chaos URL or feature involved
- What you observed and the date and time of observation
- The minimum safe steps needed to reproduce it through intended use
- The likely impact, stated separately from speculation
- Redacted screenshots or logs that contain no secrets or personal data
Email tonyelfata@gmail.com with the subject “Code Over Chaos Security Report.” Ordinary email is not an encrypted disclosure channel. Never send passwords, access tokens, private keys, personal records, proprietary code, weaponized payloads, or unlawfully obtained material.
Reports are reviewed as capacity permits; no response or remediation deadline is promised. If an issue creates an immediate risk to life, public safety, or another provider's systems, contact the appropriate service owner or emergency authority.
PRIMARY SOURCES
The disclosure standards behind this path.
IETF RFC 9116: security.txt ↗
Machine-readable contact, expiry, policy, canonical-location, and no-implied-permission requirements.
CISA Vulnerability Disclosure Policy Template ↗
Government guidance for clear scope, reporting, authorization, restrictions, and coordinated handling.
This page is a reporting policy, not permission to access systems, data, accounts, or functionality beyond ordinary intended public use.