Security

We keep skunkcodes.com small and simple, which also keeps it safe:

• every page is served over an encrypted connection (HTTPS);
• there are no forms, accounts or logins, so there is nothing to break into;
• there are no cookies, analytics or third-party trackers (see our Cookie Policy);
• we keep the website's software and dependencies up to date.

Security is part of every project from the first commit. In the products we build, we:

• use secure defaults and well-tested libraries instead of rolling our own;
• review code before it ships;
• keep passwords, keys and other secrets out of the code;
• encrypt data in transit, and at rest wherever the platform supports it;
• keep dependencies up to date and act on security alerts;
• design around common risks such as those in the OWASP Top 10.

When you give us access to your systems or data, we only use what we need for the work, and we follow the security and confidentiality terms in our agreement with you.

We handle personal data in line with the Turkish Personal Data Protection Law No. 6698 (KVKK). When a project ends, we return or delete access and data as agreed.

We protect our own accounts with strong, unique passwords and two-factor authentication, give each person only the access they need, and keep our devices and tools up to date.

If you believe you have found a security issue in this website or in a product we built, please tell us. Email [email protected] with “Security report” in the subject line and include:

• a description of the issue and where you found it (URLs, app or version);
• the steps needed to reproduce it;
• what an attacker could do with it;
• how we can reach you for follow-up questions.

We will confirm that we received your report, keep you updated while we investigate, and let you know when the issue is fixed.

When looking for vulnerabilities, please:

• only access or change data as far as needed to show the issue, and never other people's data;
• don't run denial-of-service attacks or anything that slows the website down;
• don't use social engineering, phishing or physical attacks against us or our clients;
• keep the details private until we have fixed the issue, and give us a reasonable amount of time to do so.

The following are not covered:

• issues in third-party services we link to, such as map providers;
• reports from automated scanners without a working example of real impact;
• denial-of-service, spam or social engineering.

If a product we built belongs to a client, we will coordinate with them on the fix.

If you act in good faith and follow these guidelines, we will not take legal action against you for your research, and we will work with you to understand and fix the issue. If you would like, we are happy to thank you publicly once it is resolved.

We don't currently offer paid rewards for reports.

For anything security-related, write to us at [email protected] or by post: