Security disclosure policy

Scope

This policy covers:

• the DecCentral marketing site — the pages served at https://www.dwendle.com, including this site's security.txt record; and
• the DecCentral application at app.dwendle.com.

The underlying hosting platforms themselves (Dreamhost, Heroku, Google Workspace, GitHub) are not ours to authorize testing against — report issues in those platforms to their own security programs.

What we authorize

We authorize good-faith security research against the properties in scope: testing that respects users, avoids destruction, and stops at proof. Specifically, please:

• Make a good-faith effort to avoid privacy violations, data destruction, and interruption of service.
• Stop and report as soon as you can demonstrate an issue — don't pivot deeper, exfiltrate data, or persist access to prove impact.
• Never access, modify, or delete data that isn't yours. If you encounter someone else's personal data, stop and tell us.
• Don't run denial-of-service tests, spam, or social-engineering campaigns against us or our users.

Our commitment to you

If you follow this policy, we will not pursue or support legal action against you for your research. We consider good-faith research conducted under this policy to be authorized. We will work with you to understand and resolve the issue, and we won't share your report with third parties beyond what fixing the problem requires.

How to report

Email security@dwendle.com with what you found, where you found it, and how to reproduce it. Please don't include sensitive personal data in your report.

What to expect

We'll acknowledge your report within five business days. Please give us a reasonable opportunity to address an issue before sharing it publicly.