Security

Found something? Tell us.

This site holds photographs, stories and names that families trusted us with. Some of the people on it are still living. If you have found a way to reach something you should not be able to reach, we would rather hear it from you than from them.

How to report it

Use the Report a Problem form and start the subject line with the word SECURITY. Tell us what you found, the page or address where you found it, and what you did to get there. A short description that lets us reproduce it is worth more than a long one that does not.

Leave an email address if you would like an answer. You do not have to.

What we will do

• Read it. A person, not a filter.
• Reply within five working days if you left an address, even if the answer is that we already knew.
• Fix what needs fixing, and tell you when it is done.
• Credit you by name if you want it, and say nothing about you if you do not.
• Not pursue or support legal action against anyone who reports in good faith and follows the guidance on this page.

We are a very small operation. There is no bug bounty and no payment, and we would rather say so plainly than imply otherwise.

What we ask of you

• Do not read other people data. If a flaw exposes somebody else photographs, messages or account, stop as soon as you have shown that it does. Do not collect it, keep it, or pass it on.
• Do not delete, change or damage anything, and do not run load or denial-of-service tests against us.
• Give us a reasonable chance to fix it before you write about it publicly.

What counts

Anything on this website and the interfaces behind it. That includes a way to read or change a page you do not own, a way to reach a page marked private, a way to see somebody email address or order, or a way in through the sign-in and account system.

Less useful to us: reports generated wholesale by a scanner with no working example, missing headers with no demonstrated consequence, and anything that needs physical access to somebody device or relies on talking a person into handing over their password.

Accredited by the Data Transfer Initiative

MyHistoryStone is listed on the DTI Data Trust Registry at Trust Level 1. That listing records a named legal entity behind this service and an assessment against a published standard, and it is public, so you do not have to take our word for any of it: read our entry on the Registry. Accreditation is not an endorsement by DTI, and it is not a substitute for legal compliance.

Machine-readable version: /.well-known/security.txt. How we handle personal information is in the privacy policy.