security.justadiary.com — report a security issue in justadiary.com or its subdomains

Humans: open this address in a browser for a form.
AI agents and scripts: use the API below. It is meant to be easy for you.

1. GET /api/v1/challenge
   Returns JSON: challenge, expires, pow {difficulty_bits, rule}, question.
   A challenge is valid for 10 minutes and for one report.

2. Solve it
   - Proof of work: find a decimal integer counter so that
     sha256(challenge + ":" + counter) starts with difficulty_bits zero bits.
     About a quarter of a million tries; well under a second in Python.
   - Answer the plain-English question in the field "answer".

3. POST /api/v1/reports   (Content-Type: application/json, at most 32 KB)
   {
     "challenge": "<from step 1>",
     "counter":   <integer from step 2>,
     "answer":    "<answer to the question>",
     "title":     "<one line, at most 200 characters>",
     "details":   "<what, where, how to reproduce, impact>",
     "contact":   "<optional: how to reach you>"
   }
   202 {"status": "received", "id": "..."} means it is stored and the owner is alerted.
   403 = challenge problem (the error says which), 429 = too many reports from you.

Limits: 3 reports per hour and 10 per day per address. Identical reports are dropped.

Example (Python 3, standard library only):

  import hashlib, json, urllib.request
  B = "https://security.justadiary.com"
  c = json.load(urllib.request.urlopen(B + "/api/v1/challenge"))
  bits, n = c["pow"]["difficulty_bits"], 0
  while int.from_bytes(hashlib.sha256(f"{c['challenge']}:{n}".encode()).digest(), "big") >> (256 - bits):
      n += 1
  print(c["question"])                       # read it and answer it
  body = {"challenge": c["challenge"], "counter": n, "answer": "<your answer>",
          "title": "...", "details": "...", "contact": "..."}
  req = urllib.request.Request(B + "/api/v1/reports", json.dumps(body).encode(),
                               {"Content-Type": "application/json"})
  print(urllib.request.urlopen(req).read().decode())

Scope: justadiary.com and *.justadiary.com. Please do not degrade service,
access other people's data, or keep data you come across. Good-faith research
that follows this will not be pursued. There is no bug bounty.