Report a problem

We teach people how systems break, so we want to hear about it when ours does. If you find a security problem on this website, tell us and we will fix it.

What's in scope

This website, at the address you are reading it on.

What's not in scope

• UM6P systems, including the university network and student accounts
• our Discord server
• third party services we link to, such as Discord, GitHub and the platforms on our path

Please do not test any of them. Report problems there to their owners.

Safe harbor

If you test this website in good faith, stay in scope, and give us time to fix what you find before you share it, we will not take action against you. Good faith means no denial of service, no automated scanning that floods the site, and no attempts on anyone's account or data.

How to report

Write to 0xsshelite@gmail.com with the page, what you found, and the steps to see it again. We read every report and will answer within a week.

Hall of Fame

No reports yet. Valid reports are listed here, with your permission.

About our headers

GitHub Pages hosts this site and decides its HTTP response headers, so we can't set a Content Security Policy header. We put the policy in a meta tag on every page instead. That is a known limit, not something you need to report.

The hidden flag

The hidden flag is a puzzle, not a vulnerability. Finding it takes no attack, and the rest of this policy still applies.

What runs in your browser

The "This page can see you" panel on the home page and your rank in the shell use only your browser. Nothing they read is sent anywhere. Your rank is kept in this browser's local storage; clear it and you start again as user.