Security policy

Reporting a vulnerability

Email hello@geohandbook.io with enough detail to reproduce the issue. A machine-readable version of this contact information is published at /.well-known/security.txt following RFC 9116.

Please do not open a public issue or post the details publicly before the issue is fixed. There is no bug bounty — this is a one-person publication, not a funded product — but credit is given on the changelog to anyone who reports something real and wants it.

What to expect: acknowledgement within a week, and either a fix or an explanation of why something is not in scope. If a report is valid and a fix ships, the commit appears in the public changelog like any other change.

What this site actually is

Scope is easier to judge with an accurate picture of the architecture, so: GEOhandbook is a static site. Pages are pre-rendered to HTML by Eleventy at build time and served from Cloudflare’s CDN.

There is no application server, no database, no user accounts, no login, no session handling, no file upload, no search backend, no comment system, and no server-side code executing per request. Nothing a visitor does is written anywhere on the origin.

This eliminates most of the OWASP Top Ten by construction rather than by defence. It is worth being blunt about that, because a vulnerability report describing SQL injection or broken access control on this site is describing something that does not exist to be broken.

In scope

• Content injection in the published HTML — anything that lets attacker-controlled markup or script reach a page, including via the markdown pipeline.
• Cross-site scripting in any generated page or endpoint.
• Response header and transport problems — missing or misconfigured security headers, TLS configuration, mixed content.
• Subdomain takeover or dangling DNS records on geohandbook.io.
• Supply-chain issues in the build dependencies that would alter what gets published.
• Third-party embeds behaving in a way that harms readers, including the advertising units.
• Data leakage — anything in the repository or published output that exposes credentials, keys or private information. Note that the IndexNow API key is designed to be publicly served at a known URL as proof of domain control, so finding it is not a vulnerability.

Out of scope

• Missing security headers with no demonstrated impact on a site that has no cookies, no authentication and no user state.
• Attacks requiring a compromised reader device, browser extension, or physical access.
• Denial of service, volumetric or otherwise, against Cloudflare’s network.
• Automated scanner output submitted without a working proof of concept or an explanation of impact.
• Vulnerabilities in the content of third-party sites this site links to. Every outbound link is a citation of a source, not an endorsement of that source’s security.
• Email spoofing concerns unrelated to published DNS policy for this domain.
• Reports that amount to “your site is static and lacks feature X”.

Reader privacy

The site sets no first-party cookies and runs no analytics. Advertising is served by Google AdSense, which does set third-party cookies and is covered in the privacy policy and the advertising disclosure. Concerns about AdSense’s own behaviour are Google’s to answer, but a report showing an ad unit on this site causing concrete harm to readers is in scope and will be acted on — including by removing the unit.

This policy was last reviewed on 20 September 2026.