Skip to content
JobPuul

Security Policy

Last updated November 5, 2026

This document is published in English only — the English version is the legally binding one, whatever language you use JobPuul in.

Thanks for helping keep JobPuul and its users safe. This is how to report a vulnerability to us, and what we promise in return. Machines find the same contact at /.well-known/security.txt.

Reporting a vulnerability

Email security@jobpuul.com. Plain text is fine; PGP is not required. Write in English or Czech.

Please do not report a suspected vulnerability anywhere public: not on social media, and not through the contact form or a public issue.

What to include

  • The affected URL, page or API endpoint
  • Steps to reproduce (minimal proof-of-concept preferred)
  • Observed impact and a realistic worst-case scenario
  • Any suggested mitigation, if you have one

How we respond

Best-effort targets — JobPuul is a solo project, and these will occasionally slip around travel, illness, or major life events:

  • Acknowledgement: typically within 72 hours
  • Triage and severity assessment: typically within 14 days
  • Fix or mitigation: within 90 days for high/critical; best-effort for low/medium
  • Coordinated disclosure: the issue may be made public once a fix ships, or 90 days after your report, whichever comes first. Tell us before you publish

If you haven't heard back within the acknowledgement window, please nudge — the email may have been mis-filtered.

JobPuul is pre-release and ships continuously from one version, so only what runs at jobpuul.com today is supported with security fixes.

Scope

In scope:

  • jobpuul.com and its first-party APIs, including any *.jobpuul.com subdomain we operate
  • Our source code, its build and deploy pipeline, and the container images we publish
  • Self-hosted infrastructure we run directly

Out of scope (please report directly to the vendor):

  • Third-party services we depend on: Cloudflare, Hetzner, Paddle, Resend, GitHub itself
  • Generic best-practice findings without a demonstrated impact (e.g., missing security headers with no exploit path)
  • Volumetric DoS or DDoS — please do not stress-test our production
  • Issues that require physical access to our infrastructure

Please don't

  • Publicly disclose before we've coordinated a fix
  • Run automated scanners that generate sustained load — rate-limit and identify yourself in the User-Agent
  • Use social engineering, phishing, or physical attacks against us, our users, or third parties
  • Access, modify, or exfiltrate data that isn't yours; stop at proof-of-concept

Safe harbor

If you act in good faith and follow this policy, we will:

  • Treat your research as authorised access under this policy. We will not pursue civil action.
  • Not report you to law enforcement for the act of researching the vulnerability. We acknowledge that under Czech law (Trestní zákoník §230 — neoprávněný přístup k počítačovému systému) the criminal-prosecution decision is the state's, not ours. If a prosecution is initiated despite your good-faith compliance with this policy, we will affirmatively confirm to investigators and the court that your access was authorised under this written policy and support your defence.
  • Treat any reverse engineering or anti-circumvention activity strictly limited to identifying the vulnerability as authorised under this policy.
  • Not seek damages for any unintended harm caused by good-faith research, provided you stopped at proof-of-concept and reported promptly.

The safe harbor does not cover deliberate harm, data exfiltration beyond what's necessary to prove the issue, public disclosure before coordination, extortion, or activity outside the scope above.

If you're unsure whether a planned test crosses the line, ask first — emailing security@jobpuul.com before you act is always welcome.

Recognition

There is no bug bounty today. With your permission, we credit you by name or handle in anything we publish about the issue; you may stay anonymous.