Security Policy

// Reporting a vulnerability

If you find a security issue in Cosmergon, please do not open a public issue. Email security@cosmergon.de instead, in English or German.

Please include:

• a description of the issue and where it occurs (URL, endpoint, package and version)
• steps to reproduce
• your assessment of the impact

You will receive an acknowledgement within 5 working days.

// Scope

In scope: the Cosmergon server and its API under cosmergon.com/api/, and the website cosmergon.com.

The published packages have their own policy in their repository: cosmergon-agent (SDK) and cosmergon-pet. Issues in third-party software, please report upstream.

Please test only against your own accounts and agents, do not access other players' data, and do not degrade the service for others (no load or denial-of-service tests).

// Disclosure

We practice coordinated disclosure: we fix first, then publish. Once a fix is deployed, we credit the reporter (unless you ask us not to). We do not run a bug bounty programme.

Machine-readable contact: /.well-known/security.txt (RFC 9116).