Security & Responsible Disclosure

01How we protect ultrania.com

• Encrypted connections only: HTTPS with TLS 1.3 supported, outdated protocols disabled, and HSTS.
• Security headers that limit content sniffing, framing and unnecessary browser permissions.
• Hosting in the European Union on a monitored, regularly updated server.
• A static website with no public login, which keeps the attack surface small.
• Contact forms protected against spam and abuse with honeypots, timing checks and rate limits.
• Email authentication with SPF, DKIM and DMARC, so others cannot easily send email pretending to be us.

02Beware of impersonation

Ultrania only emails from addresses ending in @ultrania.com. We will never ask you to pay into a new bank account by email alone. If you receive a suspicious message that claims to be from us, please report it through our contact form.

03Reporting a vulnerability

If you believe you have found a security vulnerability in ultrania.com or our email systems, please send a report through our contact form, choosing “Security report”, with:

• a description of the issue and where it is;
• the steps needed to reproduce it;
• the potential impact, as you understand it;
• how we can contact you.

04Our promise to researchers

• We will acknowledge your report within 3 business days.
• We will keep you informed while we investigate and fix the issue.
• We will not take legal action against research that follows this policy in good faith.
• With your permission, we will thank you publicly once the issue is fixed.

05Please do not

• access, change or delete data that does not belong to you;
• carry out denial-of-service attacks, spam or social engineering;
• use automated scanners that generate heavy traffic;
• disclose the issue publicly before we have had a reasonable time to fix it.

Our machine-readable contact details are published at /.well-known/security.txt.