Reporting a security problem

If you have found a security problem in addisgazette.com, please tell us. We read every report, and we would rather hear about a problem from you than from someone who uses it.

How to report

Email addisgazette@proton.me. You can write in English or Amharic. Please include:

what you found, and the address (URL) or part of the site where it is;
the steps to show it, with any requests you sent;
what someone could do with it;
how we can reach you, and whether you want to be named when it is fixed.

What we do

We reply within 5 working days to say we have your report.
We confirm the problem on a copy of the site and fix it within 48 hours if it is critical, 7 days if high, 30 days if medium and 90 days if low, counted from your report.
We tell you when it is fixed, and name you if you want us to.
We do not run a paid bug bounty.

Please

Test only with accounts you created yourself, and stop as soon as you can show the problem.
Don't read, change or delete other people's data, and don't keep any you happen to see.
Don't slow the site down or take it offline: no denial-of-service tests, floods or mass automated scans.
Don't try to trick our staff or readers, send spam, or test our offices or people in person.
Give us a reasonable time to fix the problem before you publish anything: until it is fixed, or 90 days.

If you follow this policy

We will treat your research as done in good faith. We won't take legal action against you over it or ask anyone else to, and if someone else does, we will say that you worked within this policy.

Not covered

Reports from automated scanners that don't show a real problem.
Missing headers or settings with no way to harm anyone, and clickjacking of pages with nothing to click.
Email records such as SPF or DMARC, and rate limits on forms that do nothing sensitive.
Services we use but don't run, such as Stripe or the services you can sign in with (Google, Apple, Microsoft, Facebook, X): please report those to them.

The same contact is published in machine-readable form at /.well-known/security.txt. Updated 31 October 2026.

How to report

Email addisgazette@proton.me. You can write in English or Amharic. Please include:

what you found, and the address (URL) or part of the site where it is;

the steps to show it, with any requests you sent;

what someone could do with it;

how we can reach you, and whether you want to be named when it is fixed.

What we do

We reply within 5 working days to say we have your report.

We confirm the problem on a copy of the site and fix it within 48 hours if it is critical, 7 days if high, 30 days if medium and 90 days if low, counted from your report.

We tell you when it is fixed, and name you if you want us to.

We do not run a paid bug bounty.

Please

Test only with accounts you created yourself, and stop as soon as you can show the problem.

Don't read, change or delete other people's data, and don't keep any you happen to see.

Don't slow the site down or take it offline: no denial-of-service tests, floods or mass automated scans.

Don't try to trick our staff or readers, send spam, or test our offices or people in person.

Give us a reasonable time to fix the problem before you publish anything: until it is fixed, or 90 days.

Not covered

Reports from automated scanners that don't show a real problem.

Missing headers or settings with no way to harm anyone, and clickjacking of pages with nothing to click.

Email records such as SPF or DMARC, and rate limits on forms that do nothing sensitive.

Services we use but don't run, such as Stripe or the services you can sign in with (Google, Apple, Microsoft, Facebook, X): please report those to them.

The same contact is published in machine-readable form at /.well-known/security.txt. Updated 31 October 2026.