Machine-readable security contact

Security tooling can also use our security.txt file. The human-readable guidance on this page remains the authoritative scope and safe-testing notice.

What to include

A useful report should identify the affected URL, product or game, explain the potential impact, and provide concise reproduction steps. Screenshots or proof-of-concept material may be included where they do not expose another person's data or secrets.

Safe testing expectations

Security research must remain lawful and proportionate. Do not:

• access, alter, download or retain data belonging to another person;
• use denial-of-service, traffic flooding or resource-exhaustion techniques;
• use social engineering, phishing, physical intrusion or attacks against third-party providers;
• plant malware, persistence mechanisms or destructive payloads; or
• continue testing after you have enough evidence to demonstrate the issue safely.

Handling reports

We review credible reports and prioritise them according to potential impact and exploitability. We may ask for additional technical detail. This page does not create a guaranteed response time, payment obligation or bug-bounty programme, and it does not authorise activity that would otherwise be unlawful.

Abuse and non-security reports

For spam, impersonation, content abuse or similar misuse that is not a technical vulnerability, contact abuse@dervalyn.com. Product support should be sent to support@dervalyn.com.

Privacy

If a security issue involves personal information, we will handle the matter under our internal incident process and applicable legal obligations. Privacy questions and rights requests should be sent to privacy@dervalyn.com.