Security Disclosure Policy 🔐

Found a crack in the tavern's walls? Thank you for looking. This page explains how to report it properly, what I promise in return, and why you don't need to be afraid of reporting it.

Effective date: June 12, 2025

You spend your time making Character Tavern safer, so here's what I owe you in return:

• ✅ Acknowledge your report quickly
• ✅ Investigate every reported vulnerability properly
• ✅ Keep you in the loop while I work on a fix
• ✅ Never take legal action against good-faith research under this policy
• ✅ Credit your find publicly, if you want the credit

The more of this you give me, the faster the fix ships:

• 📌 A clear description of the vulnerability
• 📌 The location (URL or API endpoint)
• 📌 Step-by-step reproduction instructions
• 📌 The potential impact of the issue
• 📌 Your name or alias for credit (optional)

1. 1

   Acknowledgment

   within 3 business days

2. 2

   Triage

   I review and validate the issue

3. 3

   Remediation

   a fix is developed and deployed

4. 4

   Notification

   you're told when it's resolved

5. 5

   Recognition

   public credit, with your permission

Good-faith vulnerability research under this policy is considered authorized, and no legal action will be taken against you for it. In exchange, act responsibly: don't exfiltrate, misuse, or disclose user data, and avoid disruptions, privacy violations, or degrading the service for everyone else. Poke the hole, prove it exists, stop there.

There's no bug bounty budget here, but valid submissions get public credit under the name or alias of your choice, plus my genuine gratitude. Prefer to stay anonymous? Fully respected, no questions asked.