Security Policy

about this policy

This policy covers all software, tools, bots, and websites published by Nathan B. ("py.") — collectively the "Services".

reporting a vulnerability

If you believe you've found a security vulnerability in any of our Services, please report it privately so it can be fixed before it's disclosed publicly.

Contact: berrnathan@gmail.com

Please do not open a public issue, post details in chat/Discord, or otherwise disclose the issue publicly until it has been addressed.

When reporting, include where you can: which Service (and version / OS, if an app) is affected; a description of the issue and its potential impact; and clear steps to reproduce (proof-of-concept if possible).

what to expect

We aim to acknowledge your report within a few days. We'll investigate, keep you updated, and work on a fix as quickly as is reasonable for a community project. With your permission, we're happy to credit you once a fix is released.

These are unfunded community projects, so we don't operate a paid bug-bounty — but good-faith reports are genuinely appreciated.

safe-harbor for good-faith research

We will not pursue or support legal action against researchers who, in good faith:

• make a reasonable effort to avoid privacy violations, data destruction, and service disruption;
• only interact with accounts/data they own or have explicit permission to test; and
• report promptly and give us reasonable time to remediate before public disclosure.

Activities beyond this (e.g. accessing other users' data, attacking third-party platforms our Services connect to, or extortion) are not authorized.

scope notes

Our apps are generally local-first and store credentials in your operating system's secure credential store; reports about local data handling, update integrity, or credential storage are in scope.

Issues in third-party services our apps connect to should be reported to those providers, not us — though we appreciate a heads-up if it affects how our apps behave.

contact

Nathan B. — berrnathan@gmail.com — pyth.co.za