Please do not report security problems in public issues, discussions or Discord.

Report them privately with GitHub's private vulnerability reporting: open the repository's Security tab and choose Report a vulnerability. For anything not tied to one repository, use Everloot/everloot. Include what you found, how to reproduce it, and what an attacker could do with it.

We will answer within a few days and keep you posted until it is fixed. Once a fix is live we are happy to credit you, if you want.

In scope: everloot.app and its APIs, the MCP endpoints, the addon, the desktop companion and every Everloot repository. Please do not test against other players' data, run load tests against the site, or use social engineering.