Security

How to report a security problem in everloot.app, its APIs, the MCP server or the addon privately, what is in scope, and what to expect from us.

How to report

Please do not report security problems in public issues, discussions or Discord. Report them privately, either through GitHub's private vulnerability reporting or by email to hello@everloot.app with “Security” in the subject. Include what you found, how to reproduce it, and what an attacker could do with it.

The same contacts are published in the machine-readable security.txt file.

What to expect

We will answer within a few days and keep you posted until it is fixed. Once a fix is live we are happy to credit you, if you want.

In scope

everloot.app and its APIs, the MCP endpoints, the addon, the companion and the repository. Please do not test against other players' data, run load tests against the site, or use social engineering.

What the site already does

The code is open, so you can read what runs. Uploads are previewed before they are sent and published without install ids, and without names unless the player granted sharing, the way the methodology describes. Passwords are never handled here: sign-in goes through Battle.net, and Everloot stores no provider tokens.