Privacy & terms.

Privacy

harshsec.in is the personal portfolio of Harsh R., a student in India. I'm the only person who runs it. This page explains what data the site touches and why. If anything here is unclear, email harshsec@proton.me.

What this site collects

• Contact form. Your name, email and message — only if you send them. They go to my inbox through Formspree and are used only to reply to you.
• AI terminal. What you type is sent to my server and on to an AI provider (currently Google Gemini) to generate a reply. Don't type anything private there. I don't store conversations.
• Capture the flag. If you submit a flag, the handle you choose and which flags you've solved are stored so the leaderboard works. To stop brute-forcing, a one-way hash of your IP address is kept for about 10 minutes, then deleted automatically.
• Server logs. Like every website, the hosting provider (Vercel) briefly records technical request data such as IP address, browser and pages requested, for security and reliability.

That's it. There are no analytics scripts, no ad networks, no fingerprinting and no tracking pixels.

Third-party services

Some features load directly from other services, which means your browser connects to them and they can see your IP address:

• Vercel — hosts the site.
• Formspree — delivers the contact form.
• Upstash — stores the CTF leaderboard.
• Lanyard & Discord — show my live Discord status and avatar.
• Last.fm — shows what I'm listening to (album art loads from its servers).
• GitHub contributions API — draws my contribution graph.
• Image hosts — a few project images on the Work page load from Unsplash, Pinterest and LinkedIn.

Each of these has its own privacy policy. All fonts and scripts are self-hosted — nothing loads from Google Fonts or public CDNs.

Cookies & storage

This site uses only what it needs to work, and none of it tracks you:

• theme — a cookie and local-storage entry that remember light or dark mode.
• hsec-ctf — local storage that remembers your CTF handle so nobody else can use it.
• The vault admin login lives in session storage and disappears when you close the tab.

Clearing your browser's site data removes all of it.

Your choices

You can ask me to see, correct or delete anything you've sent — a contact message or your CTF handle and score. Email harshsec@proton.me and I'll handle it within 30 days, in line with India's Digital Personal Data Protection Act, 2023.

CTF rules

The five flags are hidden in plain sight and need nothing more than curiosity and your browser's built-in tools. While playing:

• Don't attack the server, APIs or hosting — no scanning, brute force, denial of service or automated submission.
• Don't try to access other players' data or the vault admin area.
• Keep handles friendly. Offensive names are removed.
• Sharing hints is fine; posting all the flags spoils it for everyone else.

Responsible disclosure

Found a real security issue? Thank you. Please email it privately to harshsec@proton.me with steps to reproduce, give me reasonable time to fix it, and don't access or change data that isn't yours. Good-faith research done this way is welcome. I'm a student, so there's no bug bounty — but you'll get credit and genuine thanks. Details are also in security.txt.

Terms of use

• Content. The writing, design and images here are © 2026 Harsh R. You're welcome to link to them or quote a little with credit; please don't copy the site as a whole and present it as your own.
• No warranty. Everything here, including writeups and code, is shared for learning and provided as is. Use it at your own risk.
• Security content. Writeups cover legal practice labs and CTFs. Only test systems you own or have written permission to test.
• External links. I'm not responsible for content on other sites.

Changes & contact

If this page changes, the "last updated" date at the top changes too. Questions about anything here: harshsec@proton.me.