Security Policy
We protect servers for a living, so we want to hear about weaknesses in our own systems before anyone else finds them.
Reporting a vulnerability
- Join our support server and open a ticket titled Security report. Do not post details in public channels.
- Describe the issue, the steps to reproduce it, what an attacker could do with it, and any proof of concept.
- Give us a reasonable time to fix it before telling anyone else. We aim for 90 days at most, and much faster for serious issues.
Scope
In scope
- The Mark Defender bot and its slash commands and buttons.
- This website, the dashboard and the verification page.
- The bot's API that the dashboard talks to.
- License, branding and blacklist logic, for example using a key you do not own or editing a server you do not manage.
Out of scope
- Discord, Cloudflare, Vercel or our hosting provider themselves. Report those to the company that runs them.
- Denial of service, spam, or load testing.
- Social engineering of our staff or users.
- Reports from automated scanners with no demonstrated impact, missing best-practice headers without an exploit, or self-XSS.
- Attacks that need a compromised Discord account or device to begin with.
Rules for testing
- Test only on servers you own, with accounts you own.
- Do not access, change or delete data belonging to anyone else. If you reach someone else's data by accident, stop and tell us.
- Do not run destructive actions against real communities to "test" anti-nuke.
What we promise
- We confirm we received your report and keep you updated while we fix it.
- We will not take legal action or ask Discord to act against you for research done in good faith under this policy.
- With your permission, we credit you in our support server once the fix is live.
We do not run a paid bug bounty at this time.
How we protect the service
A summary of our practices is on the Trust center. How we handle personal data is in the Privacy Policy and the Data Processing Agreement.