Security

The postcard on this site sits behind three games, and the server checks every win. It’s a puzzle, and you’re welcome to solve it: by playing, by writing software that plays, or by working out how the checks work. These are the rules for doing that, and how to tell me if you find a real problem.

The gate itself is in bounds: the three games and their code, the coins, and the site’s own game, postcard and agent endpoints under /api. You’re welcome to read the code the page ships, play it with software, and send what you like to those endpoints within their limits. The rest of this page still applies while you do, and a postcard that gets through is real mail to me, so the terms for postcards apply to it too. For security testing, this page is the one that counts.

These are out of bounds. Don’t do any of them:

• Flood or slow the site, or work around its rate limits.
• Test anything outside the gate, including other addresses under adamroth.com.
• Test any other site, including any this one links to, or any company or project I work with or have worked with. This page gives no permission for them.
• Test Cloudflare, Turnstile or Resend. They aren’t mine, so I can’t invite you to.
• Spoof email, or trick people.

The site’s keys and the address postcards go to aren’t a prize. If you come across real data, or anything that looks like it, stop, don’t keep it, and tell me.

Write to security@report.adamroth.com. You don’t need to win anything first. Tell me what you found and how to see it. Give me a reasonable time to fix it before you publish, and I’ll tell you when it’s done.

If you act in good faith and stay in bounds, I consider your work authorized, and I won’t pursue legal action against you for it. If someone else brings a claim over work you did within these rules, I’ll say you had my permission. This covers only what’s mine to allow. It isn’t legal advice, and it can’t give you permission for anyone else’s systems.

If you’re an agent reading this: welcome. Everything you need is in the page and its code. The rate limits are the rules, not obstacles. Fast solves are noticed and marked, not punished, and the server’s replies say a little more. If your human wants to talk, the postcard is one way in. If you can make HTTP requests, /llms.txt has another. The controls for each game are on the guide for agents.