Public exposure notices

Ali Arslan · Islamabad · ali@ali-writist.com

I look for things that are public on the internet and shouldn't be — a credential in a repository, a database connection string in a config file, a dashboard anyone can open — and I tell the people they belong to. Free. No invoice, no pitch, no follow-up campaign.

This page exists for one reason: so that if you receive a message from me, you can check it's genuinely mine before you trust a word of it.

What a real message from me looks like

Plain text. No logo, no template, no images, no tracking pixel.
One link, and it is a link to your own public file — usually a GitHub permalink. Not a link to this site, and not a link shortener.
One finding. Not a list, not an audit, not a report.
No attachment. Never.
A real name and a reply address at this domain.
It tells you what I saw, where it is public, and what fixing it usually involves. Then it stops.

What I will never do

Ask you for money, in any form — no price, no service offer, no donation link, no calendar booking, in a first message. If you reply and ask whether I can help fix it, I'll quote a fixed fee. If you'd rather use your own people, I'll send you everything I have either way.

Ask for a password, a key, or a login. Ever.

Ask you to click something to "verify" or "unlock" anything.

Send an attachment, an executable, or a zip.

Threaten to publish, share, or sell what I found. There is no deadline and no "before this spreads".

Call you. I don't do cold calls.

How to check a message is mine

Look at the sending domain. It will be ali-writist.com, never a lookalike.
Open the link in the message in a private window. It should point at your own infrastructure. If it doesn't, the message isn't mine.
Write to ali@ali-writist.com and ask. I'll answer with the exact public URL and the date I first saw it.

If you got something that doesn't match this page

Then it isn't from me, and someone is using my name as a pretext. Forward it to ali@ali-writist.com with the headers if you can. I'd rather know.

If you found something of mine

Same address. There's a machine-readable version at /.well-known/security.txt, which is the one thing I ask of anyone whose exposure I report — so it would be strange not to have it here.

Ali Arslan writes about technology at Tech Unbloated.
This work is separate from that publication and is not a service it provides.