Security

In scope

• This website, dynohash.com.
• The stats server, api.dynohash.com.
• Official DynoHash builds.
• Fake sites and fake builds pretending to be DynoHash. Send us those too.

Ground rules

• Test with your own data. Do not read, change or delete anyone else’s.
• No denial-of-service tests, no spam, no social engineering of people.
• Give us a reasonable time to fix a problem before you publish it.

Good-faith research that follows these rules is welcome, and we will not take action against it.

What you can expect

• We aim to reply within 7 days, and to say what we found and what we will do.
• We will credit you when the fix ships, if you want that.
• We cannot pay bounties.

How the stats server is built

• HTTPS only. It answers browsers from dynohash.com only, and refuses any other origin.
• Every report is checked against a strict published schema. Unknown fields, oversize bodies and markup are rejected before anything is stored.
• It stores no IP addresses and keeps no request logs. Rate limits use in-memory counters and a daily-salted one-way hash that is deleted each day.
• The beta sign-up form is protected by Cloudflare Turnstile, strict validation and rate limits, and addresses are used only to send the beta download.
• It has no admin endpoints. Moderation is done out of band, never over the internet.
• Output is plain JSON with a locked-down content security policy. The Strip page builds its rows with text only, never HTML from the server.

The machine-readable policy is at /.well-known/security.txt.