home / contact

Contact

Coordinated disclosure is welcome.

Get in touch

form
the form below — the only way to reach me; every message lands in my private inbox
pgp
PGP key & secure contact ritual for encrypted reports
response
acknowledgement within 3 business days
policy
90-day disclosure unless agreed otherwise

Send a message

plain or encrypted

Sensitive report? Encrypt it with my PGP key and paste the armored message below. Do not send credentials, live customer data or working exploit code in plain text. If your report is encrypted, mark the topic as a disclosure and tell me which key you used.

Priority flags your message for reading order only. It does not shorten the disclosure window.

0 / 8000 characters

Prefer the ritual on the PGP page. Plain text is fine for non-sensitive reports.

Protected by reCAPTCHA. Google’s Privacy Policy and Terms apply.

How your message is handled

  • Transport. The form is submitted over HTTPS to Formspree, which forwards it to my mailbox. There is no database on this site and nothing you send is rendered back onto a page.
  • Sanitisation. Fields are length-limited here and escaped server-side by Formspree before they reach me, so your input is handled as text, never as markup or code. Links arrive as plain text; I open anything I do not recognise with care.
  • Spam. A hidden decoy field plus reCAPTCHA keep automated submissions out.
  • Storage. Formspree holds the submission until it is delivered. I keep reports for as long as the disclosure needs, then delete them. See the privacy policy.
  • Sensitive data. Encrypt it first. Nothing sent through this form is end-to-end encrypted beyond HTTPS, and it will pass through Formspree and Google’s reCAPTCHA service.

Elsewhere

profiles and code
LinkedIn
linkedin.com/in/wmouton
GitHub
github.com/wmouton
GitLab
gitlab.com/wmouton
Codeberg
codeberg.org/wmouton
X
@wmouton_sec

Disclosure policy

Reporting to me

Send a minimal reproduction and the affected versions. Please encrypt anything sensitive with my PGP key. I will acknowledge within three business days and keep you updated.

How I disclose

  • Findings are reported privately to the vendor or owner first.
  • Testing is limited to what is needed to prove the issue: no real data is kept, no service is degraded.
  • The default window is 90 days from report to publication; I will agree a different timeline if there is a good reason.
  • Nothing is published until it is fixed, and never with exploit payloads or identifying details. See the sanitization policy.

What I accept, what is in and out of scope, and what I do and do not do is set out in scope & boundaries.