If you believe you have found a security vulnerability in Judicium, please report it to us privately using the contact below. This policy explains what we ask of you and what you can expect from us.
1. Reporting a vulnerability
Send vulnerability reports to tokbot-contact@proton.me. Do not report vulnerabilities in public channels, the support server, or on social media before we have had a reasonable chance to fix them.
Useful reports include a clear description of the issue, the affected feature or page, steps to reproduce, the impact you believe it has, and any proof of concept. Please keep proof of concept to the minimum needed to show the issue.
2. Rules of testing
Only test against accounts, servers and data that you own or have explicit permission to test.
Do not attempt to access, log in to, take over, or modify anyone else's account, server, messages or data.
Do not test against real users or real protected servers in a way that affects them. Use your own test accounts and your own test server.
Do not access, copy, store, or share data that you do not need to demonstrate the issue. If you encounter personal data, stop, do not keep it, and tell us in your report.
Do not use social engineering, phishing, or physical attacks against our staff, users or service providers.
Do not perform denial-of-service testing, spam, or any action that degrades the bot, the website, or Discord for others.
Do not attempt to exfiltrate data, pivot into other systems, or persist access once you have demonstrated a vulnerability.
Do not publicly disclose a vulnerability until we have confirmed it is fixed, or 90 days have passed since your report, whichever is sooner, unless we agree otherwise.
3. Out of scope
Vulnerabilities in Discord, Cloudflare, or other third-party services, which should be reported to those providers directly.
Issues that require a compromised device or account owned by someone else.
Missing best-practice headers or rate-limit observations without a demonstrated security impact.
Automated scanner output submitted without validation.
Content or enforcement decisions, such as bans and appeals. Please use the appeal process for these.
4. What you can expect
We will acknowledge your report as soon as we reasonably can.
We will assess the report and keep you informed of significant progress.
We will work to fix confirmed issues in a timely manner, prioritising by severity.
We will credit you in our changelog or on this page if you wish, once the issue is fixed.
We do not currently offer monetary rewards for reports.
5. Good-faith research
We will not take legal action against researchers who act in good faith and follow this policy. This statement is not a promise of immunity from third parties, and it does not override any law that applies to you.
6. Changes and contact
We may update this policy and will change the "Last updated" date when we do. Questions about this policy or reports can be sent to tokbot-contact@proton.me.