Security Policy
How to report security vulnerabilities to suomalainen.email.
Scope
This policy covers security vulnerabilities affecting:
- The suomalainen.email domain and its subdomains
- DNS configuration (DNSSEC, SPF, DKIM, DMARC)
- TLS/SSL configuration and certificate validity
- Web server configuration and HTTP security headers
- Email server infrastructure and protocols
- Unintended exposure of sensitive information
Out of scope
The following are outside the scope of this policy:
- Denial of service attacks
- Social engineering or phishing attempts
- Physical security
- Spam and abuse (report to postmaster@suomalainen.email)
- Vulnerabilities in third-party services we depend on
- Theoretical vulnerabilities with no practical impact
- Missing security headers rated as informational only
How to report
Please send vulnerability reports to postmaster@suomalainen.email. Include a clear description of the issue, steps to reproduce, and your assessment of the potential impact. We welcome coordinated disclosure.
What to expect
- Acknowledgment of your report within 3 business days
- An assessment of the reported issue within 10 business days
- Regular updates while we investigate and address the issue
- Credit in our acknowledgments if you wish — just let us know
Safe harbour
We will not take legal action against researchers who discover and report security vulnerabilities in good faith, provided they:
- Do not access, modify, or delete data beyond what is needed to demonstrate the vulnerability
- Do not perform destructive testing or degrade service availability
- Do not disclose the vulnerability publicly before we have had a reasonable opportunity to address it
- Act in compliance with applicable law
Note on site architecture
suomalainen.email operates as an almost entirely static website with no user accounts and no client-side JavaScript. The sign-up form posts to a small server-side endpoint that validates a username and an email address and stores them. The attack surface is intentionally narrow. We particularly welcome reports about infrastructure-level issues such as TLS configuration, DNS security, and email authentication records.
Last updated 24 August 2026.