Report a vulnerability

What's in scope

• sudosecurity.org and its subdomains: the blog, account, Forums & Learn, the free tools, Billing, the game server panel and this status page.
• Hardline and its release/update channel.
• Elevated VPS and game server infrastructure we operate.
• towerofelements.com.

Out of scope: denial-of-service or load testing, spam, social engineering of staff or customers, physical attacks, other customers' servers, and reports that are only missing best-practice headers with no real impact. Third-party services we use (Cloudflare, payment processors, Ghost itself) should be reported to them.

Safe harbor

If you make a good-faith effort to follow this policy, we won't take legal action against you or ask anyone else to. That means: only test against your own accounts, stop and report as soon as you can show the problem, don't access, change or keep other people's data, don't degrade the service, and give us a reasonable time to fix it before going public.

What to expect

• We confirm we've received it within 3 business days.
• We send a first assessment within 10 business days.
• We aim to fix critical issues within 30 days and keep you updated until it's resolved.
• We ask for a 90-day disclosure window, or less once it's fixed. We're happy to credit you.

We're a small team and don't run a paid bug bounty yet. We do credit researchers below with their permission.