Security Disclosure Policy
Security Policy v2.0Version 2.0 · · Governance 2.0 public evidence surface
Governance 2.0 Overview
This page is part of the starnum public Governance 2.0 surface and uses the same evidence layer as the system card, data governance, transparency report, use policy, and security policy.
Governance Summary
This page defines how security contact, disclosure boundaries, crawler access, and release integrity are publicly documented.
Scope
security.txt route, crawler policy, deployable security artifacts, disclosure constraints, GPG state, and evidence registry links.
Implementation Status
Version 2.0 keeps security details public enough for verification without exposing secrets or exploitable internals.
starnum.com.tw values the security of user data and the website. We welcome security researchers to report potential vulnerabilities through responsible disclosure, and we commit to responding openly, respectfully, and promptly.
Contact
Please report security issues through the following channel:
- Instagram DM: @mychenan (received directly by the astrologer — all security issues should go through this channel)
This site is operated by a single person. The astrologer handles reports directly, which is faster than traditional email.
Machine-readable version: /.well-known/security.txt (compliant with RFC 9116)
Scope
- Primary domain: starnum.com.tw and all subdomains
- Cloudflare Workers (API endpoints)
- Frontend HTML/JS/CSS (XSS, content injection)
- Supabase backend data access control
- Authentication and authorization flows
Out of scope: Third-party services (Cloudflare infrastructure itself, Google Analytics, Supabase platform itself), social engineering attacks, physical security.
What to Include in Your Report
- Vulnerability description and impact scope
- Steps to reproduce (the more detail, the better)
- Affected URL(s) / component(s)
- Screenshots or PoC (Proof of Concept), if applicable
- How you would like to be credited (public / anonymous)
Timeline Commitments
| Milestone | Target Timeline |
|---|---|
| Acknowledgement of receipt | Within 3 business days |
| Initial assessment and severity classification | Within 7 business days |
| Low/medium risk fix | Within 30 days |
| High risk fix | Within 60 days |
| Critical vulnerability fix | Within 90 days (will notify proactively if more time is needed) |
| Public disclosure (coordinated) | After fix is complete, timing coordinated with researcher |
Our Commitments
- Confirm receipt of your report and maintain communication throughout
- Not take legal action against researchers who report in good faith
- Notify you after the fix, and publicly acknowledge you with your consent
- If you wish to be credited publicly, list your name or handle on our thanks page
Researcher Rules
- Do not access or modify other users' data
- Do not conduct denial-of-service (DoS/DDoS) testing
- Do not publicly disclose vulnerabilities until we confirm the fix is complete
- Testing scope is limited to the Scope listed above
Hall of Thanks
We thank the following security researchers for helping improve the security of starnum.com.tw:
- (The first reporter will be permanently recorded here)
HTTPS and Data Security
- Site-wide enforced HTTPS (Cloudflare Pages + HSTS preload)
- HTTP security headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
- Dependency vulnerability scanning performed locally on a regular basis
- Pre-commit hook automatically checks for API key leaks and merge conflict markers