What there is to protect
The calculators run in your browser. There are no accounts, passwords or payments here, and the numbers you type into a calculator stay in your browser unless you reload or share a link that carries them in its address. Two things do leave it: a message you send through the contact form, which Google Apps Script delivers to us, and, only if you accept analytics, the usage data Google Analytics records. Cloudflare hosts the site. The privacy policy has the detail.
How to report
- The page address, and what you did, step by step, so we can repeat it.
- What happened, and what someone could do with it.
- Screenshots or a short proof of concept, if you have them.
Please don’t send anyone else’s personal data. If a problem exposes some, describe it without copying it.
In scope
calculatormatters.com and every page on it, the contact form, and the public calculator API under /api/ described on the developers page.
Out of scope
- Cloudflare, Google Analytics and Google Apps Script themselves: report a flaw in their services to them.
- Denial of service, load testing and high-volume automated scanning.
- Social engineering, phishing, and anything that needs physical access.
- Scanner output with no shown effect on this site.
Testing rules
- Use only your own data and your own messages.
- Stop once you have shown the problem, and don’t keep, change or delete data that isn’t yours.
- Give us a reasonable time to fix it before you publish anything about it.
What happens next
You’ll get a reply within 5business days saying whether we can reproduce the problem, and we’ll tell you when it’s fixed. There is no bug bounty: reports are not paid. Research done in good faith under these rules is welcome, and we won’t take legal action over it.
The same contact details are published for tools at /.well-known/security.txt.
