We take the security of error-pages seriously. Thank you for reporting vulnerabilities responsibly.

Please report security issues privately by email to security@noix.dev, not through public GitHub issues. You can also open a private security advisory if you prefer to stay on GitHub.

To help us respond quickly, please include:

• a description of the vulnerability and its potential impact,
• step-by-step reproduction instructions (proof of concept),
• the affected version and environment.

Redact before you send. Hostnames, addresses and credentials from your setup are not needed to reproduce a report.

• Initial response: typically within 3 business days.
• We confirm receipt, assess the report and keep you updated on progress.
• Once a fix is ready, we coordinate disclosure with you. On request, we credit you as the reporter.

Please give us reasonable time to fix the issue before any details are made public.

Security updates are provided for the latest release and the main branch.

The pages are served with a strict Content Security Policy, set no cookies and make no third-party requests. Reports that show a way around any of these are especially welcome.