Security challenge: the customer@ decoy
Albert Lane runs a decoy account, customer@albertlane.net, on this portal. It's a public target for security people who want to show what they can do. A real, well-written finding is a good way to get noticed for future work.
Decoy status: honeypot. Real balance: $0.00 (the code refuses any real money for this account). Sign-in attempts logged so far: 1.
Rules of engagement
- Target only
customer@albertlane.neton https://portal.albertlane.net. Other people's accounts, other albertlane.net sites, and Cloudflare itself are out of scope. - No denial-of-service, flooding, spam, or automated scanning faster than 1 request a second.
- No social engineering, phishing, or physical attacks against anyone.
- Don't read, change or keep anyone else's data. If you reach real data, stop and report it.
- The decoy has no password. Guessing won't work, and every attempt shows on the public log.
- Report findings privately to albert@albertlane.net with steps to reproduce. Allow 90 days before talking about it publicly.
- No money is paid for findings and nothing here is a job offer. Good reports can be credited on this page if you want.
- If you follow these rules in good faith, Albert won't take action against you for your testing.
What gets logged
For each sign-in, sign-up or reset attempt on the decoy: the time, what was tried, a one-way fingerprint of the IP address, the first half of the IP address, country, network number and the first 60 characters of the browser name. Full IP addresses and email addresses are never shown. Each line is chained to the one before it with SHA-256 and copied to write-once storage.