Found something? Tell me.
Reports go straight to the one person who can fix them.
Scope. This policy covers robinsonlabs.ai and its subdomains: a static site plus mail. If you believe you have found a security issue here, email [email protected] with the details in plain text. Say what you found, where, and how to reproduce it. No attachments, please.
What to expect. You will get a reply within a few business days, a straight answer on whether the issue is real, and a fix if it is. If you want credit for the find, say so and you will get it. To be clear up front: Robinson Labs does not run a paid bug bounty program and does not offer monetary rewards. If that ever changes, this page will say so.
Ground rules. Good-faith research is welcome. Do not degrade the service, do not access or retain data that is not yours, no denial-of-service or volumetric testing, no social engineering. Report what you find and allow a reasonable window for a fix before publishing. Research that stays inside these rules will not be met with legal action.
Out of scope. Raw scanner output without a demonstrated impact; SPF, DKIM, or DMARC policy strength; clickjacking on pages with no authenticated actions; missing security headers without a working exploit; software version disclosure; the fact that arbitrary subdomains resolve (wildcard DNS is intentional). Reports on these will be read, but they are known and accepted.