Security Policy

1Reporting a vulnerability

Report security issues in Lunar's bot, dashboard, API or any site listed under Safe harbor privately to [email protected], in English or Hebrew. Include a description, steps to reproduce and the impact, and leave out other people's personal data.

We cannot promise a response time, but we review reports we receive and work with you to confirm and fix valid issues. Please allow us up to 90 days before disclosing an issue publicly. We use the details in your report only to handle it and, if you wish, to credit you.

2How Lunar protects your data

The measures below describe what is in place today and are not a guarantee.

• Our sites are served over HTTPS only, through Cloudflare.
• Dashboard sessions are protected and expire within 30 days, and every action is checked against the access the server has given you.
• Uploaded pictures are verified and have location and camera data removed before they are stored.
• Public pages are rate limited, and our logs exclude credentials and private links.
• Tokens Lunar must use on your behalf, such as a server's own bot token, are stored encrypted.
• Records of staff activity and of purchases are signed when written and cannot be changed through Lunar.

Encrypted logging

A server can turn on encrypted logging. Its logs, ticket transcripts, moderation reasons, form answers and staff activity are then encrypted with keys that are created in the browser and held only by the server's key holders, so we cannot read them. Encryption uses ML-KEM-1024 together with RSA-3072, and records are signed to show who sealed them. Some details, such as who an entry relates to and when, stay readable so that records can be listed.

If every key holder loses their passphrase, the data cannot be recovered by anyone, including us. Removing a key holder does not withdraw anything they already accessed; a key rotation stops them opening the data we hold.

3Safe harbor

If you make a good-faith effort to follow this policy while researching, we consider your testing of Lunar's own systems authorized, we will not take legal action against you for it, and we will work with you to resolve the issue. Research that follows this policy is not a breach of the Acceptable use section of our Terms.

This safe harbor covers only the Lunar bot and the services at thelunarbot.com, api.thelunarbot.com, forms.thelunarbot.com, status.thelunarbot.com and cdn.thelunarbot.com. It does not cover servers' own custom bots, any other site, or third parties such as Discord, Cloudflare, Polar and NOWPayments, whose own policies apply.

4Testing rules

• Report privately, and allow up to 90 days for a fix before public disclosure.
• Use only accounts and servers you own or have permission to use, and no more access than you need.
• Do not access, change, delete or keep other people's data. If you encounter it, stop and tell us.
• Do not degrade or disrupt the service, including by denial of service, spam or high-volume scanning.
• No social engineering, phishing or physical attacks.
• Do not attack Discord, Cloudflare or other services Lunar relies on.
• Do not ask for payment or anything else in return for a report.

5No bounty, but credit

There is no paid bug bounty. If you report a valid issue, we will credit you by name or handle once it is fixed if you wish, or keep you anonymous.

6Credits

Fonts: Figtree, Schibsted Grotesk and Heebo (SIL Open Font License), served by Bunny Fonts. Icons: Tabler Icons (MIT). Emoji: Twemoji by Twitter, Inc. and other contributors (CC BY 4.0). Charts: Chart.js (MIT). Encryption: noble-curves and noble-post-quantum by Paul Miller (MIT). Right-to-left text: bidi-js (MIT). Dashboard: Alpine.js (MIT). Music in the promo film: "Newer Wave" by Kevin MacLeod (incompetech.com), CC BY 4.0. The Lunar name, mascot and artwork belong to Moonthia and are not covered by these licenses.

7Contact