Vulnerability Disclosure Policy

1. Our commitment

UnhingedForge welcomes good-faith reports that help protect our users, software, website, and community systems. We will investigate credible reports, communicate in good faith, and work toward proportionate remediation. This policy does not create a bug-bounty program or promise payment.

2. Scope

• The official UnhingedForge website and pages hosted under its published domain.
• The Unhinged Apprentice Discord bot and its future interactions within an official UnhingedForge server.
• ComPALion builds distributed through an official UnhingedForge channel, including approved testing builds.
• Endless Wanderer builds only when a build or testing notice expressly states that it is in scope.

3. Authorized good-faith research

Research is authorized under this policy only when you use accounts and data you own or have permission to use, make a genuine effort to avoid harm, stop after proving the issue with the minimum access necessary, protect information encountered, and report promptly and privately.

• Use low-volume manual testing or purpose-built tooling that does not degrade service.
• Create the smallest proof needed to demonstrate impact; do not establish persistence or expand access.
• If you encounter another person’s data, stop, do not copy it, record only what is necessary to explain the exposure, and report immediately.

4. Prohibited testing

• Denial-of-service, load testing, message flooding, raids, spam, mass account creation, or resource exhaustion.
• Social engineering, phishing, impersonation, credential collection, bribery, threats, or physical intrusion.
• Malware, destructive payloads, ransomware, data alteration, deletion, corruption, persistence, or supply-chain compromise.
• Accessing, downloading, retaining, or publishing personal information, private communications, source code, secrets, or files beyond the minimum proof.
• Testing other users’ accounts, evading bans, disrupting moderation, or targeting staff personally.
• Public disclosure, sale, extortion, or sharing exploit details before coordinated disclosure is complete.

5. How to report

1. Email the company contact below with the subject “SECURITY REPORT – [short issue name]”. The website will identify any additional official reporting channel after it becomes available.
2. Include the affected asset and version, date observed, prerequisites, clear reproduction steps, expected versus actual behavior, impact, and the minimum sanitized evidence needed to verify it.
3. Include a safe contact method and whether you request public credit. Do not send live secrets, weaponized payloads, unnecessary personal data, or executable malware.

6. Response targets

Targets are not guarantees. We may ask for more information, combine duplicates, prioritize actively exploited issues, or refer an out-of-scope issue to a third party.

7. Safe harbor

When you comply with this policy, we consider your research authorized and will not initiate or recommend legal action against you for that research. If a third party initiates action, we may state that your activity was conducted under this policy. We cannot authorize conduct involving third-party systems or waive rights held by anyone else.

If you are uncertain, contact us before proceeding. Accidental good-faith mistakes will be evaluated in context, but deliberate harm, extortion, privacy invasion, or continued testing after being told to stop is not protected.

8. Coordinated disclosure and credit

Do not publicly disclose the vulnerability until we confirm remediation or agree on a disclosure date. Our default coordination window is up to 90 days after validation, with extensions for complex fixes or earlier disclosure for actively exploited risks when coordinated responsibly.

We may credit a researcher who requests recognition, acted responsibly, and did not violate this policy. Anonymous reporting is accepted, but it may limit our ability to clarify the report or provide updates.