Report a security issue
We built this site to be hard to attack: static files only, no logins, no forms, no database, no JavaScript. If you've found a way around that, we'd genuinely like to hear about it.
How to report
Email **security@watchmanhq.com**. Our machine-readable contact details are in /.well-known/security.txt.
Please include what you found, where, how to reproduce it, and what you think an attacker could do with it. Plain text is fine.
In scope
watchmanhq.comand its subdomains.- The integrity of the feed: anything that would let someone change, replace or poison the files under
/feed/, or make an indicator appear as a working link.
Out of scope
- Findings from automated scanners with no demonstrated impact.
- Missing best-practice headers or settings that don't lead to a real problem.
- Denial-of-service, spam or social-engineering tests.
- The third-party sites we link to. Please report those to their owners.
- Problems with what's on a list (a false positive). Use Report a false positive for those.
Our promise to you
If you act in good faith, we won't pursue or support legal action against you. Good faith means you:
- only test against systems in scope;
- don't access, change or delete data that isn't yours, and don't degrade the site for anyone else;
- stop and tell us as soon as you've confirmed a problem; and
- give us a reasonable time to fix it (90 days, or sooner by agreement) before telling anyone else.
There's no bug bounty: this is a free project with no budget. With your permission, we'll gladly thank you by name on this page.
Checking the feed hasn't been tampered with
Every release has a manifest.json with a SHA-256 checksum for each file, and our scripts in How to block check it before installing anything. If a file ever doesn't match its manifest, don't use it, and please tell us.