TS TOMEK.ST
Search PL Contact Write
SECURITY / DISCLOSURE

Security vulnerability disclosure.

This page covers only the tomek.st website and related public infrastructure. It is not an invitation to test client systems or third-party sites.

Scope

  • The tomek.st site (public pages, contact form, APIs under this domain).
  • Public endpoints that this site itself exposes.

Out of scope: client networks, accounts and applications; mass scanning; social engineering of private individuals; DoS; attempts to bypass mail, hosting or DNS provider controls without prior written permission.

How to report

Email hello@tomek.st with security in the subject, or use the contact form (topic “Other”) with a short write-up. Enough detail: URL or endpoint, reproduction steps, impact, a screenshot or log without passwords and without third-party personal data.

The file /.well-known/security.txt points to the same contacts.

What I do not expect

  • An unsolicited full-domain automated scan “just in case”.
  • Production exploitation beyond confirming impact.
  • Public disclosure before a reply — I usually answer within a few business days.
  • A paid bug bounty; acknowledgement and a fix are the default.

Contact availability

Phone: phone temporarily unavailable. Ordinary reports by email or form: reply usually within 1 business day. This is not a round-the-clock SOC or a retainer for client systems.