Legal and policies

Responsible Disclosure Policy

Effective October 25, 2026. Last updated October 25, 2026.

In short

If you find a security problem on hockeytape.ca, we want to know. Report it privately by email, give us reasonable time to fix it and act in good faith. We will not pursue legal action for good-faith research that follows this policy.

1. Scope

hockeytape.ca is run by Scott Plumptree in Vancouver, British Columbia. This policy covers hockeytape.ca, including its pages and the endpoint that receives form submissions.

Out of scope:

  • Third-party services we do not control, such as Cloudflare and Airtable. Report issues in those services to the provider.
  • Physical attacks
  • Social engineering, phishing or other attempts to trick Scott Plumptree
  • Denial-of-service attacks or load testing

2. How to Report

Email scott@plumptree.com with:

  • The affected URL or endpoint
  • Steps to reproduce the issue
  • What you think the impact is

3. Guidelines (Safe Harbour)

  • Act in good faith.
  • Avoid privacy violations, data destruction and disruption of the site.
  • Send only as many test submissions through the forms as you need to show the issue.
  • Do not access or keep more data than you need to show the issue.
  • Give us reasonable time to fix the issue before you disclose it publicly.

Research that follows this policy is authorized. We will not pursue or support legal action against you for it.

4. What to Expect

We aim to acknowledge your report within 3 to 5 business days, give you our assessment, and keep you updated until it is fixed.

We do not run a bug bounty and do not pay for reports. If you want, we are happy to credit you.

5. Please Do Not

  • Access, change or delete other people’s data, including form submissions
  • Disclose the issue publicly before we have fixed it
  • Use what you find for anything other than reporting it in good faith

Contact

Security reports: scott@plumptree.com.

© 2026 Scott Plumptree. All rights reserved.