Security Policy

If you find a security problem on idzan.hr, please tell me privately first, and I will work with you to fix it. This page explains what you can test, how to report it, and what you can expect from me in return.

idzan.hr is a personal website run by one person. It is a static site with a small private admin area. Reports are read and handled by me, Marko Idžan.

Scope

Only idzan.hr itself is in scope. Services run by other companies are out of scope, even when idzan.hr uses them.

In scope

• The public website at https://idzan.hr and its pages
• The site's admin area, if you come across it (please do not try to guess or force your way in)
• Security headers, cookies and the cookie consent banner, when a weakness has a real impact

Out of scope

• Services run by others: the hosting provider, the CDN and DNS provider, email providers, and social networks linked from the site. Report problems there to those companies.
• Denial of service, load or stress testing, and spam
• Social engineering, phishing, or physical attacks against me or anyone else
• Reports from automated scanners with no proof that the issue can be used
• Missing best-practice headers or settings with no shown impact
• Clickjacking on pages with no sensitive actions
• Self-XSS, or issues that need an already compromised device or browser
• Software version numbers or banners on their own
• Email settings (SPF, DKIM, DMARC) unless you show a working spoofing attack
• Rate limits on public pages that change nothing

How to report

Email your report to marko@idzan.hr or marko.idzan@protonmail.com, with “Security” in the subject line. Please write in English or Croatian.

A good report includes:

1. The page address (URL) and what is affected
2. The steps to reproduce the issue
3. What an attacker could do with it (the impact)
4. A proof of concept, such as screenshots, a short video, or the request you sent
5. Your name or handle, if you would like to be thanked publicly

To send an encrypted report, use the PGP key listed in https://idzan.hr/.well-known/security.txt. Sending from a Proton Mail address to marko.idzan@protonmail.com is also encrypted automatically.

Please do not report security issues in public places, such as social media or public code repositories.

Rules for testing

Test carefully, and stop as soon as you have shown the problem exists.

Please do

• Use only your own test data and accounts
• Keep automated tools slow, at no more than a few requests per second
• Stop testing and report straight away if you reach someone else’s data or the admin area
• Delete any data you got while testing, once the issue is fixed
• Give me reasonable time to fix the issue before you talk about it publicly

Please don’t

• Try to log in with guessed or stolen passwords, or attack two-factor login
• Change, delete or copy data you do not own
• Upload malware, or leave backdoors or test files on the server
• Slow the site down or take it offline
• Break the law, including the laws of Croatia and the EU

What happens after you report

I aim to reply within 3 working days and to fix confirmed issues within 90 days. Serious issues get fixed first.

This is a one-person site, so a reply can take longer during holidays. If you hear nothing within 10 working days, please send a short reminder.

I follow coordinated disclosure. Once the fix is live, you are welcome to write about the issue. Please check the date with me first and leave out other people’s personal data.

Safe harbor

If you follow this policy in good faith, I will not take legal action against you or report you to the authorities for your research.

Good faith means you stay in scope, follow the rules above, and report what you find to me privately. This promise covers only idzan.hr. It does not cover other companies’ services, and it does not bind anyone else. If you are unsure whether something is allowed, ask me first.

Rewards and thanks

There is no paid bug bounty: idzan.hr is a personal site with no budget for one. Please do not ask for payment before or in exchange for a report.

If you would like, I will thank you by name or handle on a thanks list on this site, once the issue is fixed. Tell me in your report how you would like to be named, or that you prefer to stay anonymous.

Your report and your data

I keep your report private and use your details only to handle it. I will not share your name or email without your permission. More about how personal data is handled is in the Privacy Statement.

Changes to this policy

I may update this policy from time to time. The date at the top shows the latest version, and the security.txt file always points to it.