Security and privacy

Buchanan Bedrock is a small, static news site. We keep it simple on purpose: the less we collect, the less there is to lose or misuse.

What we collect

• Reading the site: no accounts, no ads, no tracking cookies, and no third-party trackers. Our host keeps standard short-lived server logs to keep the site running.
• The “Tell us” form: we keep your answer, the page you sent it from, and the time. We don’t ask for your name or email. We never store your IP address. We keep only a scrambled one-way code made from it, so we can block someone flooding the form.
• Spam check: the form uses Cloudflare Turnstile to tell people from bots. It runs only on pages with the form.
• The weekly email: coming soon. When it opens, we’ll keep only your email address, and you can unsubscribe at any time.

How we protect the site

• Every page is served over HTTPS only, with strict browser security settings that block other sites from framing our pages or running scripts on them.
• The form has size limits, a spam check, and a limit on how often one connection can send.
• Passwords and keys never live in our code. Access to the site’s accounts is kept to the people who run it.

Found a security problem?

Please email contact@buchananbedrock.com with “Security report” in the subject. Tell us what you found, the page or address involved, and how to see it happen. We’ll reply within 5 business days and tell you what we did about it.

Safe harbor

If you look for problems in good faith, we won’t take legal action against you or ask anyone else to. Good faith means you:

• tell us privately and give us a reasonable time to fix it before sharing it;
• don’t read, change, or delete other people’s data, and stop as soon as you reach any;
• don’t flood the site or the form, send spam, or try to trick our readers or staff;
• test only buchananbedrock.com and its own pages.

We don’t offer paid bounties, but we’re glad to thank you by name on this page if you’d like.

Machine-readable contact: /.well-known/security.txt.