Report a security vulnerability
Please report suspected vulnerabilities privately so they can be investigated before public disclosure.
Submit a private report
Describe the affected page, reproduction steps, impact, and the smallest safe proof. Contact email is optional, but without it we cannot ask follow-up questions. Do not include passwords, cookies, account tokens, or another player’s data.
Protect account data
Do not include passwords, session cookies, or live account tokens. Do not access, change, download, or retain another player’s data. Use your own test account and stop testing if you encounter data that is not yours.
What to expect
You receive a report ID immediately. Reports with a contact address can receive follow-up after review. Confirmed vulnerabilities are handled with a reasonable coordinated disclosure timeline.
Automated scanning
Keep automated traffic low-volume and limited to this domain. Denial-of-service testing, social engineering, credential attacks, and testing third-party infrastructure are out of scope.