TestLessons Logo

Security Policy

TestLessons (Drialta Holding LLC d/b/a TestLessons) welcomes good-faith reports of security vulnerabilities affecting testlessons.com and related systems we operate. This page describes how to report issues and what to expect. Machine-readable contact details are published at /.well-known/security.txt (RFC 9116).

How to Report

Please report security issues privately:

Helpful reports include:

  • A clear description of the issue and potential impact
  • Affected URL(s), endpoint(s), or product area
  • Steps to reproduce (or a minimal proof of concept)
  • Your preferred contact method and any disclosure timeline preferences

We do not currently operate a public bug bounty or paid reward program. We still appreciate responsible reports and will credit researchers on request when a fix ships (unless you prefer to remain anonymous).

In Scope

  • https://testlessons.com and www redirects we control
  • First-party application surfaces we host (for example contact form workers, authentication/account features, and Cloudflare Pages configuration for this site)
  • Misconfigurations or flaws that could expose user data, accounts, or site integrity

Out of Scope

  • Third-party platforms we do not operate (Google Analytics, AdSense, Cloudflare platform-wide issues outside our account/project config, email providers, social networks, payment/affiliate networks)
  • Issues that require physical access, stolen devices, or compromised third-party accounts
  • Social engineering, phishing, or spam against staff or users
  • Denial of service, volumetric flooding, or resource exhaustion testing
  • Automated mass scanning that degrades service or generates excessive traffic
  • Reports limited to missing security headers, cookie flags, or best-practice suggestions without a realistic exploit path (we track hardening separately)
  • Vulnerabilities in outdated browsers, extensions, or end-user devices
  • Content accuracy, SEO, or non-security product bugs (use the normal contact form)

Safe Harbor and Rules of Engagement

If you make a good-faith effort to follow this policy, we will not pursue legal action against you for security research that:

  • Avoids privacy violations, destruction of data, and disruption of service
  • Does not access, modify, or delete data belonging to other users beyond the minimum needed to demonstrate the issue
  • Does not use social engineering or physical attacks
  • Keeps findings confidential until we have had a reasonable chance to investigate and fix

Please do not:

  • Publicly disclose an unfixed vulnerability without coordinating with us first
  • Demand payment or threaten disclosure as leverage
  • Pivot into systems outside the scope above

What Happens Next

  1. We acknowledge receipt when we can (target: within a few business days).
  2. We triage severity and reproduce when possible.
  3. We work on a fix appropriate to impact and complexity.
  4. We notify you when the issue is resolved when contact details are available.

Preferred disclosure window: give us at least 90 days from a complete report before public discussion, unless we agree to a different timeline or the issue is already widely known. Critical actively exploited issues may be handled on a faster path.

Languages

Preferred language for reports: English.

Non-Security Contact

For product questions, content errors, privacy requests, or general support, use Contact, email jim@testlessons.com, or see our Privacy Policy.