Security policy

How we protect our sites

• HTTPS everywhere, with HSTS, and a strict Content Security Policy that blocks injected scripts.
• Every change is tested on a staging copy before it goes live, and the live site is backed up first.
• Forms validate input on the server, limit message length and rate, and trap spam bots.
• Access keys are scoped to what each tool needs and kept in a secure vault, never in code or web pages.
• Analytics and other third-party code load only with your consent.

Report a vulnerability

Email security@symservices.site with what you found, where (the address and steps to reproduce it), and what impact you think it has. Our contact details are also in security.txt.

• We'll acknowledge your report within 3 business days and keep you updated until it's resolved.
• We aim to fix serious issues within 30 days and will tell you when it's done.
• If you'd like credit, we'll thank you by name once it's fixed.

Safe harbor

If you act in good faith, follow this policy, avoid harming people or data, and give us a reasonable time to fix the issue before telling others, we won't pursue legal action against you for your research.

In scope

symservices.site and our other sites: aspectora.site, bots.aspectora.site, leotter.site, printables.leotter.site and their subdomains.

Please don't

• Run denial-of-service or load tests, or send high volumes of requests or spam.
• Access, change or delete data that isn't yours; stop and report as soon as you see someone else's data.
• Use social engineering, phishing or physical attacks against us or our providers.
• Test third-party services we use (for example our host, Google, Stripe or Discord); report those to them.

We don't run a paid bug bounty at the moment.

Questions

Email hello@symservices.site. Our other policies: Privacy · Cookies · Terms · AI policy · Security.