Report a security issue.

Describe the affected URL, the issue, its potential impact and the minimum steps needed to reproduce it. Include your preferred reply address. Redact credentials, personal data and client information. Contact Nick before sending material that needs an encrypted channel; no dedicated encryption key is currently published.

This reporting channel covers nickcerutti.com. It does not authorize testing of client systems, email accounts, booking providers, hosting infrastructure or repositories with separate security policies. Do not perform denial-of-service testing, social engineering, destructive actions or access data that is not yours. If you encounter unexpected access to data, stop and report the minimum information needed to explain the issue.

Please report privately so the issue can be assessed and addressed, and coordinate any public disclosure with Nick. Nick reviews reports according to their impact, checks the reproduction steps and coordinates remediation and disclosure with the reporter. Include a reply address so Nick can ask for clarification and share findings. This is a vulnerability reporting channel; client incident-response work is agreed separately. No paid bounty is offered.

The canonical security contact file is available at https://nickcerutti.com/.well-known/security.txt. Its expiry date is maintained separately from the website deployment date.