Security

Last updated: October 2026

We take the security of dartpilot seriously. If you find a vulnerability in anything we run, tell us so we can fix it. This page explains how to report a problem, what you can test, and what you can expect from us.

How to report

Email security@dartpilot.app. Please do not open a public issue or post about the problem before we have had a chance to fix it.

What to include

• a description of the issue and the impact you think it has;
• the steps to reproduce it, with the exact URLs or the app version;
• any proof of concept, screenshots, or logs; and
• how you would like to be credited, if at all.

What to expect

• We will reply to confirm we received your report.
• We will investigate, assess the impact, and keep you updated while we work on a fix.
• We will tell you once a fix is live.

In scope

• our websites and download host: dartpilot.app,play.dartpilot.app,docs.dartpilot.app, and get.dartpilot.app;
• the public API at api.dartpilot.app;
• the dartpilot desktop app for macOS, Windows, and Linux; and
• the dartpilot mobile app.

Out of scope

• third-party services we use, such as our payment provider or our status page;
• denial of service, brute force, or load testing that degrades the service for other people;
• spam, social engineering, or phishing against our team or our customers;
• physical attacks on any venue, device, or person; and
• automated scanner output with no demonstrated impact.

Rules for testing

• Only test accounts and data that belong to you. Do not access, change, or delete anyone else's data.
• Do not disrupt the service or the experience of other players.
• Stop as soon as you confirm a vulnerability and report it, rather than going further.
• Give us a reasonable chance to fix the issue before you disclose it in public.

Safe harbor and credit

If you follow this policy, we will treat your research as authorised. We will not pursue legal action or ask law enforcement to act against you for good-faith testing that follows these rules. We do not run a paid bug bounty program, but we are glad to credit you by name or handle if you would like.

Changes to this policy

We may update this policy, and we will change the date at the top when we do. A machine-readable summary is published at/.well-known/security.txt.