Security
Responsible disclosure
Found a vulnerability or a way this site could be hacked? Thank you — report it privately and it will be fixed as fast as possible. Please do not exploit it or share it publicly before a fix is out.
How to report
Message @acczyn on Discord or email zynx0286@gmail.com with: what you found, steps to reproduce, and the impact you think it has. Expect an acknowledgement within 48 hours. Reports stay confidential.
In scope
This portfolio site itself: authentication bypass on the admin login, stored or reflected XSS via the contact form, reviews or testimonials, CSRF on admin actions, rate-limit bypasses, and information leaks (session tokens, secrets, other users' data).
Out of scope & rules
Third-party services (Roblox, Discord, Cloudflare, Resend) — report those to the vendor. Do not run DoS/load tests, do not brute-force the login beyond what's needed to demonstrate the issue, no social engineering or phishing of any person, and never access, modify, or delete data that isn't yours.
Safe harbor & bounty
Research done in good faith within these rules will not be met with legal action. There is no paid bounty program — this is a personal portfolio — but valid reporters get credit in the hall of fame below (with permission) and eternal gratitude.
Hall of fame
No reports yet — be the first. Past hardening work: login rate-limiting, HMAC-signed admin sessions, geo-fenced admin access, honeypot + time-trap + per-IP limits on the contact form, and strict security headers.