Security

Last updated 17 September 2026

If you find a security issue in penstemon.co or in anything we publish, write to info@penstemon.co with Security in the subject line. Include the steps to reproduce it and the impact you think it has.

We acknowledge reports as quickly as we can and tell you what we plan to do about them.

This covers penstemon.co and its subdomains. Qbipper is in pre-product research and development with no public deployment, so it is out of scope for now.

While you test, please hold to four things.

  • Work against your own data and your own submissions.
  • Leave denial of service testing alone.
  • Do not access, change or delete data that is not yours.
  • Give us reasonable time to ship a fix before you describe the issue publicly.

We will not pursue legal action over research that follows the terms above. When we publish a fix we will credit you by name if you want the credit.

The site is an Astro application running on Cloudflare Workers, served over TLS. It has no visitor accounts and no tracking cookies.

The contact form validates every field on the server, verifies a Turnstile token before it sends anything, and holds no mail credential in the browser.