$ loading▍
$ loading▍
// legal/security
How to report a vulnerability, and what's already in place to prevent one.
Last updated: October 12, 2026
pumpkins.dev is a one-person project. If you find a security issue in this site, the CID website, or the CID / MySQL Tray Controller downloads, I'd genuinely appreciate a heads-up before it goes anywhere public.
Email [info@pumpkins.dev](mailto:info@pumpkins.dev) with a subject line starting with [security], and include steps to reproduce, the affected URL or version, and the impact you'd expect. As a solo maintainer I can't promise a bug bounty, but I read every report and will acknowledge it within a few days.
cid.pumpkins.dev (sign-up, sign-in, project invites and the dashboard).| Area | Detail |
|---|---|
| Authentication | CID sign-in on cid.pumpkins.dev uses Auth.js with an encrypted session cookie — no passwords or API tokens are stored in the browser. |
| Transport | The site is served over HTTPS. |
| Quiz uploads | PDFs and notes submitted to the AI Quiz Generator are forwarded to Gemini and never written to disk on this server. |
| Downloads | CID and MySQL Tray Controller installers are only published through official GitHub Releases — verify you're downloading from github.com/MohsenManoochehr. |
Good-faith security research that stays within the scope above, avoids privacy violations and service disruption, and is reported responsibly won't be pursued legally.
Tell me what you're building and where you're stuck. I typically reply within a day.