Security

Report a problem

If you find a security problem in this site or in a Skribly app, write to contact@skribly.pl. Tell us where it is and how to repeat it, and please keep it private until we have fixed it.

Our contact details are also in the standard file at /.well-known/security.txt.

When you test

Please do not access other people's data, overload the site or use social engineering. A short, careful proof is enough.

This website

This site is made of static files. It has no forms and no accounts, and its only cookies keep your theme and accessibility settings, so it stores nothing about you on a server.

All fonts, images and scripts come from this site, and a Content Security Policy blocks anything else. Dependencies are audited on every deployment, and a deployment stops if the audit finds a problem.

The apps

The apps are in development and their repositories are private. Skribly Tracker gives API tokens the same roles as people and signs its webhooks. Skribly Agent and agent-skills include security audits, which you can run on your own projects.