Security

Pegel is a small, single-operator project. Security issues still get handled like a serious site would handle them. This page covers how to send a report and what to expect afterwards.

Reporting a vulnerability

Email reports to pegel@mail.pegel.berlin with the subject line [security] followed by a short description.

If you can, include four things: what the bug is, how to reproduce it, an estimate of what an attacker could do with it, and whether you would like public credit when the fix ships.

Please do not open a public GitHub issue, post on social media, or share the details publicly before a fix is deployed.

What to expect

Pegel aims to acknowledge receipt within seven days and propose an initial assessment within fourteen. Most fixes deploy within ninety days. Critical issues (auth bypass, data exposure, RCE) are faster.

If a fix is going to take longer than ninety days, Pegel will explain why and propose a revised timeline.

No bounty, with credit

Pegel has no revenue and no bug-bounty program. It can offer public credit in the /changelog and a thank-you email.

Safe harbor

Good-faith research is welcome. Specifically: avoid touching other users' data while you test. Report findings via the email above before publishing anywhere else. Allow reasonable time to ship a fix before public disclosure. If you do those things, Pegel treats your work as authorized.

Scope

In scope: pegel.berlin and its subdomains, the public API at /api/v1/*, the email digest pipeline (delivery, unsubscribe tokens, manage links), the submission and reporting forms, the admin paths, and any third-party sub-processor where the issue stems from how Pegel configures or uses the service.

Out of scope: issues in sub-processors that exist independently of how Pegel uses them (report those to the sub-processor directly: Cloudflare, Supabase, Upstash, Resend, OpenRouter, Cusdis), social-engineering against the operator, physical attacks, denial-of-service tests that do not reveal a design flaw, self-XSS that needs the victim to paste hostile content into their own console, missing security headers that do not lead to a concrete attack, and issues in third-party content (job descriptions, company names, employer logos) that come from external ATS feeds.

If you are unsure whether something is in scope, send the report anyway. Pegel would rather triage a few extra than miss a real one.