Security at SeasonalBots
Security & vulnerability disclosure
We take the security of our services and communities seriously. This page explains how to report potential vulnerabilities and how we handle them responsibly.
Report a vulnerability
Please contact us through our official support channel and request a private security-reporting conversation. Do not post exploit details publicly or in community channels.
How we handle reports
Step 1
Report privately
Share the affected service, reproduction steps, expected impact, and any safe proof of concept. Please avoid including passwords or personal information.
Step 2
We investigate
Our team reviews reports, assesses severity and exposure, and works to reproduce the issue before prioritising remediation.
Step 3
We remediate
We implement and test fixes, deploy updates, and verify the issue has been addressed where possible.
Step 4
We coordinate disclosure
We work with reporters on a reasonable disclosure timeline. We do not publish actionable details of unresolved vulnerabilities.
Our security approach
We use layered security controls, review reported findings, maintain our services, and prioritise fixes based on risk. No service can guarantee absolute security.
Responsible research
Please avoid accessing other users' data, disrupting services, social engineering, destructive testing, or exposing private information. Stop testing if you encounter sensitive data.
Transparency and updates
We may publish general security improvements and resolved issues through our changelog. We do not publish vulnerability details before remediation or disclose sensitive information about reports or reporters without permission.
SeasonalBots is operated by NodeByte LTD. This page describes our reporting process; it does not constitute a bug bounty programme or authorisation for intrusive testing.