DONE / UNDONE

Security Policy

This page describes the security scope of the DONE / UNDONE website.

About this website

This is a static editorial website. It does not provide user accounts, collect payment details, or process newsletter subscriptions directly. Public website configuration contains links and asset paths, not credentials.

External services

Newsletter subscriptions and any future paid publication memberships are managed by Substack. Links to Substack, Instagram, and TikTok take you to separate services governed by their own security and privacy policies. Never send passwords, payment details, or other sensitive information through social messages.

Secure access

Use the HTTPS address doneundone.co. If your browser displays a certificate or security warning, do not bypass it or enter sensitive information.

Reporting a security concern

A dedicated private security reporting address has not yet been published. Please do not post vulnerability details, credentials, or personal data in public comments or GitHub issues. If you contact DONE / UNDONE through its Instagram account, ask for a private reporting channel before sharing technical details.

No system can guarantee complete security. This policy is informational and does not authorize testing, scanning, or accessing systems without permission.