Report a vulnerability

If you find a security problem in MMO Run (the game, the launcher, the server, the relay, Run Market or these websites), please tell us privately before telling anyone else.

How to report

Email [email protected]. Only the maintainers read it. Please use a subject line starting with "Security:" and do not post the details anywhere public until we have fixed the problem.

Include what you found, where, what an attacker could do with it, and how to reproduce it. A proof of concept helps; a working exploit against someone else's world does not.

What happens next

• We confirm we received it within 3 days.
• We tell you whether we can reproduce it and how serious we think it is within 10 days.
• We aim to ship a fix within 30 days for serious issues, sooner for critical ones, and we keep you updated until it is done.
• When it is fixed we publish it on this site, crediting you by the name you choose (or not at all, if you prefer).

Rules of engagement

• Test against worlds, relays and registries you run yourself. You can run all of them locally; nothing about MMO Run requires testing on other people's worlds.
• Do not access, change or delete other people's data, and do not degrade the public relay or Run Market for others (no load testing, no flooding).
• Give us a reasonable time to fix the problem before you publish it.

We will not take legal action against research done in good faith within these rules.

Scope

In scope: the MMO Run game, launcher and server, and the services we run (relay.mmo.run, market.mmo.run, and the mmo.run websites). Out of scope: worlds run by other people, and extensions or style packs made by other authors (report those to their authors).