PGP Key & Secure Contact Ritual

The short version

Fetch my key from two or more sources below and confirm the fingerprints match.
Encrypt (and ideally sign) your message to that key.
Put a prefix such as [REPORT] in the subject and send it through the contact form, pasting the encrypted message into the PGP field.
Not sure your setup works? Decrypt the practice message and challenge further down first.

1. Fetch and verify my key

My fingerprint (40 hex characters):

61AF D8EA DCA1 184B E853 FAD7 0CEC E33E 3313 76E0

The key is published in several places. One source can be tampered with or go stale; several that agree are far harder to fake.

This site: /pgp/wmouton.asc
Download the file (needs pgp/wmouton.asc, see PGP_FINGERPRINT above).
GitHub: github.com/wmouton.gpg
Public keys on the GitHub profile (needs the key added to the account).
keys.openpgp.org: keys.openpgp.org
Verified keyserver: search by fingerprint once the key is uploaded and the address verified.

Download it, import it, then print the fingerprint your own copy has:

gpg --import wmouton.asc
gpg --fingerprint "W. Mouton"
gpg --list-keys --with-colons | grep fpr

Compare every group of four characters with the fingerprint above and with at least one other source (a GitHub, GitLab or Codeberg profile from the contact page works). Do not rely on a key ID or the last 8 characters; those can be forged. If anything differs, stop and do not send.

Once it matches, record that you checked it: gpg --lsign-key "W. Mouton" (or by fingerprint, once you have it).

Download wmouton.asc

2. Encrypt a message to me

Write the report in a text file, then encrypt and sign it:

FPR=61AFD8EADCA1184BE853FAD70CECE33E331376E0
gpg --armor --encrypt --sign --recipient "$FPR" --output report.asc report.txt

Paste the contents of report.asc into the PGP field on the contact form, or attach it to the form submission. Attach your own public key so I can reply encrypted.

Encryption protects the body and attachments only. The sender, recipient, subject line and timestamps stay visible to mail providers, so keep the subject generic: no product names, no hostnames, no details of the bug.

3. Subject line format

Use [PREFIX] short generic summary. Example: [REPORT] web app auth issue, details encrypted.

Prefix	Use it for	What I do
`[REPORT]`	A vulnerability report	Acknowledge within 3 business days
`[SETUP-TEST]`	Proof you passed the challenge below	Reply to confirm, encrypted
`[QUESTION]`	A question about my published work	Reply when I can; no deadline
`[COLLAB]`	Research collaboration	Reply if it fits my focus areas

4. What I will and will not respond to

I will respond to

Private vulnerability reports with a minimal reproduction and affected versions, encrypted if sensitive.
Good-faith questions about my published research.
Collaboration proposals within my focus areas.
Corrections to anything I have published, especially anything that identifies a person or organisation.

I will not respond to

Requests for exploits, payloads or help attacking a system.
Scanner output with no demonstrated impact, or anything asking for a bounty. I do not run one.
Messages that put sensitive vulnerability details in the subject line or in plaintext.
Unsolicited sales, mass recruiting mail and anything demanding urgency.
Requests to confirm my fingerprint by replying to an email. Verify it from the sources above.

Full scope, response times and my limits: scope & boundaries.

5. Practice: decrypt a test message

This uses a throwaway practice key. Its private half is published here on purpose so anyone can try, which also means it is useless for anything real. Never encrypt real messages to it.

Practice key fingerprint: EA1C D2DD F7A8 6771 D7CC E395 23D6 2B61 7ABE 5885

Download the practice private key and the test message (link below), then import the key and decrypt the message:

gpg --import practice-private.asc
gpg --decrypt test-message.asc

Test ciphertext (download). Expected output: a short line saying your install can decrypt.

Practice private key (download) and public key (download):

6. Optional: the setup challenge

This message is signed and encrypted to the practice key. Decrypting it proves your GnuPG can decrypt and verify a signature. It contains a phrase.

Download the challenge, then decrypt it:

gpg --decrypt challenge.asc

Look for Good signature in the output. Then send the phrase via the contact form with the subject [SETUP-TEST] <the phrase> in the message field, pasted encrypted to my real key into the PGP field, and I will reply encrypted. Because the practice key is public, this proves your setup works, not who you are.

security.txt

A security.txt file (RFC 9116) is published at the standard location so tools can find the right contact, key and policy.

Contact: https://wmouton.gitlab.io/contact/
Expires: 2027-09-01T00:00:00.000Z
Preferred-Languages: en
Canonical: https://wmouton.gitlab.io/.well-known/security.txt

What I accept and how fast I respond: scope & boundaries. How my own machines are set up: personal security stack.