Responsible Disclosure

Last updated: November 2026

Our Commitment

OmniColor takes the security of our site and our users seriously. We welcome reports from security researchers and we are committed to working with you responsibly to investigate and fix any issues you find.

This policy explains how to report security vulnerabilities, what you can expect from us, and what is in scope for our program.

How to Report a Vulnerability

If you have discovered a security vulnerability, please report it privately:

  • Email: security@omnicolor.pages.dev
  • Subject line: "Security Report — [brief description]"
  • Encryption: PGP key available on request for sensitive reports

What to Include in Your Report

To help us investigate quickly, please include:

  • Summary: A brief description of the vulnerability
  • Affected URL(s): Where the issue exists
  • Steps to reproduce: Clear steps to trigger the vulnerability
  • Impact: What a malicious actor could do with this
  • Proof of concept: If available, a PoC or screenshot (do not exploit the issue against real users)
  • Suggested fix: If you have an idea (optional but appreciated)
  • Your contact info: How we should reach you
  • Disclosure preference: Whether you would like to be credited publicly

What to Expect From Us

  • Within 48 hours: We acknowledge receipt of your report.
  • Within 5 business days: We provide an initial assessment of the issue (confirmed, not reproducible, out of scope, etc.).
  • Within 30 days: We aim to fix and deploy a fix for confirmed critical vulnerabilities.
  • Ongoing: We keep you updated on progress, timelines, and coordination for public disclosure.

Our Principles

  • We do not take legal action against researchers who follow this policy in good faith.
  • We will not disclose your identity without your explicit permission.
  • We will credit you publicly (in our Hall of Fame or security page) if you want.
  • We treat security reports seriously — no report is too small.
  • We respect good-faith research — if you accidentally cause a small issue while testing, we will not hold it against you.

In-Scope Targets

The following targets are in scope for security testing:

  • omnicolor.pages.dev — the main website
  • Any subdomain of omnicolor.pages.dev
  • The tools and features on the main site

Out-of-Scope

The following are out of scope (reports will be acknowledged but may not be prioritized):

  • Third-party services: Cloudflare, Adsterra, Google AdSense — report these to the respective vendor
  • Social engineering attacks against our team
  • Physical attacks against our infrastructure
  • DoS/DDoS attacks — please do not test these
  • Automated scanner noise without proof of exploitability
  • Self-XSS (requires victim to paste code into their own console)
  • Clickjacking on pages that do not require authentication
  • Missing security headers that do not directly enable an attack
  • Vulnerabilities requiring outdated browsers (IE11, older Safari, etc.)
  • Weak TLS ciphers on servers that require modern clients

What You Must Not Do

While testing, you must not:

  • Access data that is not yours — only view data that belongs to your own test account (we have no accounts, so this is mostly N/A)
  • Modify or destroy data — do not alter any content
  • Launch DoS/DDoS attacks — do not attempt to take the site offline
  • Conduct physical attacks against our offices or employees
  • Use social engineering against team members
  • Test on real users — do not exploit the vulnerability against actual visitors
  • Publicly disclose the issue before we have had a reasonable opportunity to fix it
  • Extort or threaten us based on your discovery

Coordinated Disclosure Timeline

We believe in coordinated disclosure:

  1. Report received → We acknowledge within 48 hours.
  2. Assessment → We confirm or dismiss the issue within 5 business days.
  3. Fix developed → We develop and deploy a fix (timeline varies by severity).
  4. Disclosure coordinated → We coordinate a public disclosure date with you. Typically 90 days from initial report, or sooner if we agree.
  5. Public disclosure → We publish a security advisory, you publish your write-up (if you wish).

If we cannot fix the issue within 90 days, we will discuss with you whether to disclose with the caveat that a fix is pending.

What We Do Not Offer

We are a small free project and cannot offer:

  • Monetary bounties — we do not have a paid bug bounty program.
  • Swag or physical rewards — we do not have merchandise.
  • Commercial partnerships — we cannot offer business deals in exchange for reports.

What we can offer:

  • Recognition — public credit in our security Hall of Fame (with your permission)
  • Acknowledgement — a personal thank-you from our team
  • Fast fixes — we prioritize fixing confirmed vulnerabilities quickly

Non-Security Bug Reports

For non-security bugs (tools not working, display issues, incorrect output), please use the appropriate channel:

Vulnerability Categories We Care About

The following vulnerability types are highest priority for us:

  • XSS (Cross-Site Scripting)
  • CSRF (Cross-Site Request Forgery)
  • Code injection (though we have no server-side code)
  • Dependency vulnerabilities in any third-party libraries
  • Open redirects
  • Clickjacking (on any page)
  • Data exposure (any data that should not be public)
  • Privacy issues (any way personal data leaks inadvertently)

Hall of Fame

We recognize security researchers who have responsibly disclosed vulnerabilities:

No confirmed reports yet. Be the first to help us improve security!

Contact

Security reports: security@omnicolor.pages.dev

General inquiries: Contact page

Privacy questions: privacy@omnicolor.pages.dev

Acknowledgments

Thank you to all security researchers who help make the internet safer. Your work protects users everywhere.