Security and Responsible Disclosure

Reporting a vulnerability

If you have found a security problem, email hello@keelpatches.com with SECURITY in the subject. Include what you found, how to reproduce it, and what you think the impact is.

We will acknowledge within 3 working days, keep you updated, and credit you when we publish a fix unless you would rather stay anonymous.

Safe harbour

If you act in good faith under this policy we will not pursue legal action against you, and we will say so publicly if anyone else does. That covers testing that is limited to your own data, stops as soon as you confirm a vulnerability, and does not degrade the service for anyone else.

In and out of scope

In scope: this website and anything under our domain.

Out of scope: our payment provider, WhatsApp and Meta, our hosting provider and Google Fonts. Report those to the operator directly.

We are a small operation with a static site, so please do not spend long on volumetric testing. There is no bug bounty and we are not going to pretend otherwise; what we offer is a fast, honest response and credit.

Please do not

• Run denial of service or load testing.
• Use social engineering against our staff, customers or suppliers.
• Access, modify or delete data that is not yours.
• Publish a vulnerability before we have had a reasonable chance to fix it.

What we do at our end

• The site is static. There is no customer database attached to it and no login.
• We never see or store full card numbers; payment is handled entirely by our provider.
• Security headers, a content security policy and HTTPS are configured at the edge.
• Library data stays in your browser and is never transmitted, which removes an entire class of risk rather than defending it.