Please do not report security problems in public issues, discussions or Discord.

Report them privately through GitHub's private vulnerability reporting, or by email to hello@everloot.app with "Security" in the subject. Include what you found, how to reproduce it, and what an attacker could do with it.

We will answer within a few days and keep you posted until it is fixed. Once a fix is live we are happy to credit you, if you want.

In scope: everloot.app and its APIs, the MCP endpoints, the addon, the companion, the desktop app and this repository. Please do not test against other players' data, run load tests against the site, or use social engineering.