Disclosure policy

Coordinated disclosure

If we find a vulnerability outside a paid engagement, we report it privately to the affected project first, give them reasonable time to fix it, and publish details only after a fix is available or the project agrees. We do not sell vulnerabilities or use them for gain.

If a project cannot be reached, or an issue is being actively exploited, we may contact other parties who can reduce harm, sharing only what is needed.

Reporting an issue to us

If you find a security issue in this website or in something we published, contact us privately on Discord and we will move to a private channel. Email is coming soon. Please do not post details publicly.

Safe harbor

We intend not to pursue or support action against anyone who researches and reports in good faith: who avoids privacy violations, data destruction and service disruption, does not exploit an issue beyond what is needed to show it, and gives us reasonable time to respond. This is a statement of intent, not a legal contract, and it cannot authorise testing of systems owned by others.