The German version is authoritative. This English translation is provided for convenience: https://defendr.live/de/security
Have you found a security vulnerability in Defendr? Thank you for reporting it to us. This policy tells you how to do that, what you may do while doing it and what you can expect from us.
1. What is covered
- the Discord app Defendr (the bot and its commands, buttons and direct messages);
- the website defendr.live, the personal area and server administration at app.defendr.live and the status page status.defendr.live;
- the public repository with Defendr's legal texts.
Not covered: Discord itself, Cloudflare, other third-party services, third-party threat lists and overload through mass requests. Please report vulnerabilities in third-party services to their provider.
2. How to report
Write to security@defendr.live. If you do not want to use e-mail, contact us in the Discord support server (https://discord.gg/vtPXf6t6jd) and ask for a private channel; do not mention the vulnerability in a public channel there. Please describe what is affected, how the vulnerability can be reproduced and what impact you observed. Do not send us credentials, tokens or other people's data.
3. What you may do and what not
- Test only with your own Discord account and on servers you administer yourself or for which you have the server owner's permission.
- Do not access, change or delete other people's data. If you see such data by accident, stop at once, do not keep or pass it on, and tell us in your report.
- No attacks on availability (no overload, no mass querying), no social engineering against the Defendr team or users, no spam or phishing tests against real people, no physical attacks.
- Use a vulnerability only as far as needed to demonstrate it, and keep it to yourself until it is fixed or we have agreed on a publication (section 5).
4. What you can expect from us
- We confirm receipt of your report within 72 hours.
- We assess the report, keep you informed and tell you when the vulnerability is fixed.
- We fix confirmed vulnerabilities as quickly as possible in a security update; the changelog marks it as one.
- If you agree, we thank you publicly after the fix, by name or pseudonym, for example in the changelog of the security update. We name only real reports there.
- We do not pay a reward in money or kind (bug bounty).
5. Publication
We publish a fixed vulnerability together with you. Please do not publish it before the fix and not before 90 days after your report, unless we agree otherwise. If the vulnerability is not fixed after 90 days, we agree with you on how to proceed.
6. Protection for good-faith research
If you follow this policy, we consider your research to be in good faith and welcome. We will not file a criminal complaint, request prosecution or bring civil claims against you because of it. We can give this commitment only for ourselves, not for Discord, Cloudflare or other third parties, and it does not cover acts that break section 3. If you are unsure whether something is allowed, ask us first.
7. Contact
Security vulnerabilities: security@defendr.live · General: contact@defendr.live · Machine-readable: https://defendr.live/.well-known/security.txt