Responsible Disclosure
Found a security problem in Primrose? Tell us, and give us a chance to fix it before it goes public.
How to report
Email security@primrose.games. To help us investigate quickly, please include:
- What is affected: a URL, an app, or a service.
- A description of the problem
- Steps to reproduce it
- What you think the impact is
- A way for us to reach you with follow-up questions
What to expect from us
We will acknowledge your report and keep you updated while we investigate and fix the problem. Once it is resolved, we will let you know. We will never ask you to sign a non-disclosure agreement to tell us about a security issue.
While you're researching
We ask that you act in good faith:
- Do not access or change other people's data or accounts
- Do not disrupt the service for players: no denial of service, spam, or large-scale automated scanning
- Do not use phishing or social engineering against our staff or community
- Once you have enough evidence to demonstrate the problem, stop and report it
- Do not share the issue publicly until we have fixed it and agreed the timing together
This policy does not give you permission to break the law. You are responsible for making sure your research stays within it.
security.txt
A machine-readable version of this information is published at primrosegames.com/.well-known/security.txt.