Ashley Forrest

Security_Policy

Hey there! Security is really important to me, and I know I can't catch everything myself. I truly appreciate it when security researchers lend me their eyes and expertise to help keep my site safe for everyone.

This page explains how you can let me know if you find a potential security issue.

What's Included (Scope)

This policy covers security issues found on the systems I run:

  • ashleyforrest.com (and any associated sub domains).
  • forrestlabs.dev (and any associated sub domains).

What's Not Included

I generally don't need reports about:

  • Third-party services I use (unless my specific setup is the problem).
  • Trying to knock the site offline (DoS/DDoS), phishing attempts, or physical attacks.
  • Outdated software unless you can show how it could actually be exploited.
  • Missing best practices (like certain security headers) if they don't lead directly to a vulnerability.

Found Something? Tell Me!

If you've spotted a security vulnerability on one of the systems listed above, please tell me about it as soon as you can by using the contact information shown on the Contact page.

To help me fix things quickly, please include details like:

  • What the vulnerability is and what someone could potentially do with it.
  • The exact URL(s) or parts of the site affected.
  • Clear steps so I can see the issue for myself (screenshots/code are great if they help!).
  • How I can contact you (optional, but useful if I have questions or I'd like to say thank you).

Please give me a reasonable chance to fix the issue before sharing it publicly.

What I'll Do

When you report an issue following these guidelines:

  • I'll get back to you quickly to let you know I got your report (usually within a couple of business days).
  • I'll look into it and try to keep you updated on my progress.
  • I'll work hard to fix valid issues promptly.
  • I'll promise not to take legal action against researchers who act in good faith and follow this policy (that's my Safe Harbour commitment).

I really value your help! I'm still learning a lot about web security, so I'm very open to hearing about any vulnerabilities you find – it's a great opportunity for me to learn and improve the site. While I don't have a formal bug bounty program (paying for bugs) right now, I'm grateful for your contribution to keeping things secure.

Thanks for helping me out!

Ash

Last Updated: September 18th, 2026