Security and Vulnerability Disclosure

If you've found a security problem on this site, here's how to tell us and what happens next.

Last updated: September 23, 2026.

shariqrefai.com is an educational author and media site. It doesn't hold patient records or protected health information, and it doesn't provide clinical care. We still take its security seriously, and we're grateful to anyone who reports a problem responsibly.

How to report

Email [email protected] with a short description of the issue, the URL or component affected, the steps to reproduce it, and what you think the impact is. Screenshots or a proof of concept help. The machine readable version of this contact lives at /.well-known/security.txt.

Please don't include protected health information, anyone's medical details, or personal data you came across while testing. For clinical or patient safety concerns, contact shrinkMD directly instead.

What's in scope

Pages and files served from shariqrefai.com.
The contact and notification forms and the functions behind them.
Security headers, TLS configuration, and anything that could let someone alter what readers see.

Other Shrink Network sites and third-party services such as Cloudflare, Google Analytics, and Google Fonts are outside this policy. Reports about them should go to their owners.

What we ask

Give us a reasonable window to fix the issue before you share it publicly.
Don't run denial of service tests, spam the forms, or use automated scanners at a volume that affects readers.
Don't access, change, or keep data that isn't yours, and stop once you've shown the issue exists.
Don't try social engineering or physical attacks.

What you can expect

We'll acknowledge your report, keep you posted while we work on it, and let you know when it's fixed. If you'd like credit, we're happy to name you once the fix is live. There's no paid bug bounty.

Safe harbor

If you act in good faith and follow this policy, we won't pursue legal action against you for your research, and we'll treat your work as authorized. If something is unclear, ask first at [email protected].