Vulnerability disclosure policy
Found something that looks like a security bug? Report it. This page says exactly what is in scope, what we will do with the report, and what you can expect from us in return. The machine-readable version of the contact details is at /.well-known/security.txt.
How to report
Email security@pastesite.com with a subject starting Security report. Include:
- The affected URL or endpoint, and the request you sent if it matters.
- What you expected and what actually happened.
- The smallest reproduction you can manage — a curl command, a paste link, two accounts.
- Impact as you see it: what an attacker gains, and what they need first.
- How you would like to be credited, or that you would rather not be.
Please do not open a public GitHub issue for a suspected vulnerability, and do not test against pastes that are not yours. If you need an account to demonstrate account-to-account behaviour, create two you control.
We aim to acknowledge a report within a few days. This is an independently run site, so there is no 24/7 rota and no formal response SLA — but every credible report gets read and answered.
In scope
| Area | Examples worth reporting |
|---|---|
| Access control | Reading an unlisted or password-protected paste without the password, reading or editing another account’s paste, acting as an admin |
| Authentication | Session handling, sign-up and password-reset flows, API key issuance, key or token leakage |
| Injection and XSS | Paste content that executes in another visitor’s browser, stored or reflected markup escape, markdown or screenshot handling |
| Server-side request handling | The Pastebin importer, SSRF through any server-side fetch, redirect following, rate-limit bypass |
| Data exposure | Private data in an API response, cacheable authenticated responses, secrets reaching the client bundle or logs |
| Abuse controls | Bypassing the paste, read, password-attempt or report limits |
Out of scope
- Volumetric denial of service, load testing and traffic floods. Report these to the hosting provider instead.
- Rate-limit thresholds that are merely low. If you can reset or bypass a limit, that is in scope; “10 per hour is restrictive” is not.
- Missing security headers or cookie flags with no demonstrated exploit, and best-practice scoring from automated scanners.
- Scanner output without a working reproduction. A raw report gets a polite reply and nothing else.
- Spam, abuse or illegal paste content. Use the report form, not the security address.
- Third-party services. Netlify, Supabase, Turso, Cloudflare and Pastebin are not ours to fix — report to them directly.
- Physical access, a compromised device or account, or social engineering of anyone involved with the site.
Safe harbour
If you research in good faith under this policy, we will not pursue legal action and we will not ask a provider to act against you. Good faith means:
- Only test accounts and pastes you created, or data you have permission to use.
- Do not access, modify, delete or exfiltrate other people’s content, and do not persist access you gained.
- Do not degrade the service for other people, and stop as soon as you have enough to demonstrate the issue.
- Give us a reasonable window to fix an issue before publishing anything about it.
We do not operate a paid bounty programme. We will credit you on this page if you want credit, and we will say what we fixed.
What happens next
We reproduce the report, decide on a fix, and deploy it. Most fixes ship as a single commit; there is no patch release to coordinate because the site is one deployment.
Disclosure timing: we ask for 90 days from acknowledgement, and we will happily agree to a shorter window once a fix is live. If a report is declined as out of scope, we will say why rather than leaving it unanswered.
Protections already in place
So you do not spend time re-reporting known behaviour, this is what the site already does:
- Passwords are bcrypt-hashed; API keys are stored as SHA-256 hashes with a server-side pepper and shown once.
- IP addresses are never stored raw — only salted SHA-256 hashes, used for rate limiting and view de-duplication. See the privacy policy.
- Paste content is rendered as text through React nodes: no HTML injection sink anywhere in the app, the CLI or the browser tools.
- API responses are
no-storeandnosniff; the site sends HSTS,frame-ancestors 'none'and a restrictive permissions policy. - Admin routes are gated by the server-side
ADMIN_EMAILSallowlist; leaving it unset disables them. - The Pastebin importer only reads a fixed host, never follows redirects, and caps size, time and request rate.
Frequently asked questions
Where do I send a security report?
Email security@pastesite.com with a subject starting "Security report", or use the details in /.well-known/security.txt. Do not open a public issue for a suspected vulnerability.
Do you pay bounties?
No. There is no paid bounty programme. Reports are still read, answered and credited if you want credit.
How long before I can publish?
We ask for 90 days from acknowledgement, and will agree to a shorter window once a fix is deployed.
Can I test against pastes that are not mine?
No. Use accounts and pastes you created yourself, and do not access or modify anyone else’s content.