安全政策
Security policy

私下报告

发现可利用的漏洞，请发邮件至 security@degreesignal.com，说明受影响页面、复现方法和可能的影响。不要通过公开渠道发送利用代码、凭据或个人信息。

安全港范围

仅在你善意、最小化影响、避免访问他人数据、不进行拒绝服务且给予合理修复时间时进行测试。第三方服务、社会工程和物理攻击不在范围内。

当前措施

• 同源内容安全策略、禁止嵌入、最小权限浏览器策略。
• 有界输入、来源身份与响应模式验证、不可变证据哈希。
• 生产 D1 增量迁移、发布前备份、Worker 版本回滚和运行可观测性。

Report privately

If you find an exploitable vulnerability, email security@degreesignal.com with the affected page, steps to reproduce it, and possible impact. Do not send exploit code, credentials, or personal information through public channels.

Safe-harbour scope

Test only in good faith, minimise impact, avoid other people's data, do not perform denial of service, and allow reasonable remediation time. Third-party services, social engineering, and physical attacks are out of scope.

Current measures

• Same-origin content security policy, framing denial, and restricted browser capabilities.
• Bounded inputs, source-identity and response-schema validation, and immutable evidence hashes.
• Additive production D1 migrations, pre-release backups, Worker version rollback, and operational observability.