Security
How to report a vulnerability, and the good-faith rules that keep you protected when you do.
The short version
Found a security problem in Lunar? Email it to us privately, give us a fair chance to fix it, and stay within the rules below. Good-faith research is welcome, and this page protects you while you do it. Lunar is an independent, pre-launch project run by one person, so there is no paid bounty, but we are glad to credit you.
1Reporting a vulnerability
If you find a security issue in Lunar's bot, dashboard, or API, please report it to us privately first. Email [email protected], or reach Krislyz on Discord at @krislyz. A short description, the steps to reproduce it, and the impact you think it has are enough to get started.
Lunar is run by one person and is still in closed alpha, so there is no guaranteed response time. Reports are read and taken seriously, and we will work with you to confirm and fix valid issues. Please give us a reasonable amount of time to fix an issue before sharing it publicly.
2Safe harbor
If you make a good-faith effort to follow this page while researching, we will treat your testing of Lunar's own systems as authorized, we will not pursue or support legal action against you for it, and we will work with you to resolve the issue. This is the counterpart to the Acceptable use section of our Terms: research that follows this page is welcome, not a breach of those terms.
This safe harbor covers Lunar's own bot, dashboard, and API only. It cannot authorize testing against Discord, Cloudflare, or any other third party; for those, follow their own security policies.
3Rules of the road
To stay within good faith and the safe harbor above:
- Report privately, and give us a reasonable amount of time to fix an issue before any public disclosure.
- Only use accounts and servers you own or have clear permission to use.
- Do not access, change, delete, or keep other people's data. If you come across someone else's data, stop, do not save it, and tell us.
- Do not run testing that degrades or disrupts the service for others, including denial of service, spam, or high-volume automated scans that harm availability.
- No social engineering, phishing, or physical attacks against Lunar, its operator, or its users.
- Stay within Lunar's own systems. Do not pivot to attack Discord, Cloudflare, or the other platforms Lunar relies on.
4No bounty, but credit
Lunar is an independent, pre-launch project run by one person, and there is no paid bug bounty. Reports are handled purely on a good-faith basis. If you report a valid issue and would like recognition, we are glad to credit you by name or handle once it is resolved, and you are equally welcome to stay anonymous.
5Contact
Report a vulnerability or ask a question: email [email protected], or reach Krislyz on Discord at @krislyz. See also our Privacy Policy and Terms of Service.