About /
Security
Effective
If you find a security problem on DirtyWaterWatch, please tell us. We welcome reports from anyone and will work with you to fix the problem.
What to report
- A way to see data that is not meant to be public.
- A way to change what the site shows: a water's status, a report, a page or a file.
- A problem with the contact form or its Cloudflare Turnstile check, such as a way to send messages that skip the check or to read other people's messages.
- A vulnerable dependency or setting that affects the site or its API.
- Anything else that could put the site or its readers at risk.
How to report
Use the contact form with the topic "Security". Please include:
- the page or address affected;
- the steps to reproduce the problem;
- what an attacker could do with it;
- how to reach you, if not by the email address you give in the form.
Keep the report to what we need to understand the problem. Do not include other people's personal information, and do not post the details publicly until the problem is fixed.
What we ask
- Test in good faith, only as far as you need to show the problem.
- No denial-of-service testing, heavy automated scanning or anything else that slows the site for others.
- Do not access, change or delete data that is not yours. If you reach data that is not meant to be public, stop and tell us.
- No phishing, social engineering or physical attacks, and no spam through the contact form.
- Give us reasonable time to fix the problem before you disclose it. We will agree a date with you.
If you follow this page in good faith, we will not pursue legal action against you over your research.
What we do
- We acknowledge your report, usually within a few business days.
- We look into it, fix what needs fixing and tell you when it is done.
- We credit you by name on request, once the fix is in place.
We do not offer payment or a bug bounty.
Scope
In scope: dirtywaterwatch.org, its pages and data files, and its API under /api/.
Out of scope:
- Errors in the data itself, wherever you find them (on the site, in the downloads and feeds, or in the dataset's public copy on GitHub). These are corrections, not security issues: send them through the contact form with the topic "A data error or a missing notice".
- Services we use but do not run, such as Cloudflare, Turnstile and OpenFreeMap. Report problems in those to their providers.
- Reports with no practical effect on the site or its readers, such as a missing header on a page with nothing to protect.
Our contact details for security reports are also published at /.well-known/security.txt.