Security
Found a way to break it? Tell us privately and we will fix it.
Report a vulnerability
Open a private advisory at github.com/clay-good/geoprims/security/advisories/new. Please do not open a public issue for a vulnerability. You should get a first reply within seven days.
Say what you found, how to reproduce it, and what an attacker could do with it. For the website, the page link is usually enough to reproduce it: the part after # holds every input.
What is in scope
| Area | What matters |
|---|---|
| The website | Anything that gets script or style past the content security policy, reads another site's data, or sends your inputs anywhere |
| The calculators | Memory safety in the WebAssembly modules, and any input that makes a module crash or hang instead of returning an error |
| The MCP server | Anything that makes it open a network connection, read outside its own folder, or run its input as code |
| Problem reports | Anything that stores a reporter's address, gets past the bot check or the limits, or reads another report |
| Releases | A build that does not reproduce, or a file whose published SHA-256 does not match |
A wrong answer is not a vulnerability. Use "Report a problem" at the bottom of any page instead.
What is not in scope
- Reports from automated scanners with no demonstrated impact.
- Missing headers on files that serve no data, or no rate limit on static files.
- Anything that needs a compromised device, a malicious browser extension, or physical access.
- Social engineering, and denial of service by sheer volume.
What the design already rules out
There are no accounts, no sessions, no cookies, and no calculation on a server. Every tool runs in your own browser, so there is no stored user data to reach. The only server code handles problem reports, stores no address, and answers every accepted request the same way. See Privacy for the details.
Supported versions
The current release. Fixes ship in the next release, and a security fix is labeled in the changelog.