Contact
Email is best. If you are enquiring about an engagement, the useful first message says what the application does, roughly how many endpoints and roles it has, and what is worrying you.
There is deliberately no contact form here. A form means an endpoint, an endpoint meansform-action and connect-src in the policy, and a mailto link keeps the attack surface at zero. When there is enough inbound to justify the tradeoff, it gets made explicitly rather than by default.
| paulmk2143@gmail.com | |
| GitHub | github.com/PaulAppSec |
| X | x.com/PaulAppSec |
| www.linkedin.com/in/paulappsec/ |
Timezone is UTC+3, which is near-full overlap with the UK and Europe and almost none with the US west coast. Worth knowing before you propose a call.
Reporting a vulnerability
If you have found something in this site or in anything I have published, mailpaulmk2143@gmail.com — reports are welcome and I will credit you unless you would rather I did not. Machine-readable contact details are at/.well-known/security.txt per RFC 9116.