Security

Found a vulnerability in an Aitofy package? Please tell us privately first.

How to report

Email vted001@gmail.com with SECURITY in the subject line. Please do not open a public GitHub issue, pull request or discussion for a vulnerability — a public report exposes every user before there is a fix to upgrade to.

What to include

• Which package and which version.
• What an attacker can do, and what they need to do it.
• Minimal steps or a small script that reproduces it.
• Your Node version and operating system.
• How you would like to be credited, or that you would rather not be.

What happens next

We aim to acknowledge your report within 24 hours and to tell you whether we can reproduce it and roughly when a fix will ship. We will let you know when the patched version is published, and we credit reporters in the changelog unless you ask us not to. We have no bug bounty and cannot offer payment.

Scope

In scope: the packages published under the @aitofy npm scope and the code in the repositories at github.com/aitofy-dev.

This website is static HTML with no JavaScript, no forms, no cookies and no backend, so it holds no user data and has no login to attack. Issues in Cloudflare's own infrastructure belong to Cloudflare, not to us.

Please avoid

Testing that degrades a service for other people, and any testing against third-party accounts or data that are not yours.