Found something?
Tell us first.
This preview defines the disclosure route before public testing begins. It does not claim that an address or response window is operational yet.
02 / CHANNEL
Where to send it.
Before this site is made public, Riposte must verify a dedicated mailbox, backup owner, encrypted hand-off path, and acknowledgement workflow. The address and response target will appear here only after that test passes.
What helps us act quickly
- What you tested and where (riposte.no, project infrastructure, or published code).
- Steps to reproduce, expected versus observed behavior.
- Impact as you understand it, including any uncertainty.
- How you would like to be credited, if at all.
Secrets, personal data, or exploit details beyond what reproduction requires. Never send credentials you found; describe where they are exposed instead.
Do not publish this page as an active reporting path until the channel is tested from outside the project and its backup ownership is confirmed.
03 / SCOPE
Scope and ground rules.
In scope today:
- This website and its deployment configuration.
- Project-published code and release artifacts, as they become public.
- Design flaws in the published security model that undermine its stated invariants.
Out of scope:
- Denial-of-service and volumetric testing against the website.
- Social engineering of people associated with the project.
- Third-party services we use but do not operate; report those to their owners.
The intended policy is to welcome research that stays within scope, avoids privacy violations and service degradation, and allows reasonable time for remediation. The final safe-harbour language requires review before public testing opens.
Coordinated disclosure
The planned process asks reporters for their intended disclosure timeline, agrees a fix-and-disclose plan after triage, and credits reporters unless they prefer otherwise. There is no bug bounty, public build, or active intake in this preview.
Riposte itself has no public release. Reports about the design are welcome; reports about running systems can only concern this website for now.