Security contact and disclosure policy

How to report

Email [email protected] with the affected URL, what you observed, and how to reproduce it. English or Russian. We aim to acknowledge within five working days. There is no bug bounty and no monetary reward.

What this site is

dabyte.ai is a static site served from disk, plus exactly one dynamic route: POST https://dabyte.ai/mcp, an anonymous, read-only MCP server over Streamable HTTP. GET on that path returns 405. There are no user accounts, no login, no API keys, no OAuth, no payment endpoint and no user-submitted content. All published data is free under CC BY 4.0.

In scope

• The MCP endpoint at POST /mcp: input handling, error disclosure, resource exhaustion, anything that returns data the site does not intend to publish.
• Server and TLS configuration of this host.
• Integrity of published data files and of the machine-readable documents under /.well-known/.
• Anything that lets a third party impersonate this publisher or alter a published number.

Out of scope

• Missing security headers or missing well-known documents with no demonstrated impact.
• Reports that the MCP endpoint is unauthenticated. That is deliberate and documented in /auth.md.
• Automated scanner output with no reproduction, and volumetric denial of service.
• Third-party platforms we merely link to.

Rules of engagement

Publishing this page is not permission to test. Testing must be non-destructive and rate-limited to a level that does not degrade service for others; do not attempt denial of service, do not run sustained automated fuzzing against /mcp, and do not access or modify data that is not already public here. Stop and email us at the first sign of impact. Please give us 90 days before public disclosure.