Vulnerability Disclosure Policy
We welcome reports from security researchers. Send findings to security@renewly.gg with steps to reproduce, affected URLs, and impact.
Scope
All renewly.gg subdomains and the Renewly application. Out of scope: third-party services we use (report directly to those vendors), social engineering of staff, denial-of-service testing, and physical attacks against our infrastructure providers.
Safe harbour
We will not pursue legal action against researchers who follow this policy: act in good faith, avoid privacy violations, do not exfiltrate data beyond what is needed to demonstrate the issue, and give us reasonable time to remediate before public disclosure. If a third party initiates legal action against you for activity conducted in accordance with this policy, we will make this authorisation known.
Response timeline
- 3.1We acknowledge reports within 1 business day.
- 3.2We provide a remediation timeline within 5 business days.
- 3.3Critical issues are addressed within 7 days.
- 3.4We notify the reporter when a fix ships and credit them where requested.
Bounty
We do not currently offer monetary bounties. We credit researchers in our security acknowledgements with permission.
Machine-readable contact
Our security.txt file follows RFC 9116 with the same contact and policy URLs.