Security

Found a security hole in Zaisma? Tell us privately, and you won't get in trouble for looking.

How to report

Email security@zaisma.com, or report it privately on GitHub. Say where it is, how to make it happen, and what it lets someone do. Our machine-readable contact is security.txt.

If you look for holes in good faith and stay inside the rules below, we won't take legal action against you and we won't close your account.

Test only on your own account and your own games. If you reach another player's account or data, stop at the smallest proof, don't keep it, and tell us.
No denial of service, and nothing that slows Zaisma for other players.
No spam, phishing or tricking other players, ours or anyone else's.
Never upload illegal content, even to prove a point. Child sexual abuse material has no safe harbor: it's reported and passed to the police.
Give us 90 days to fix a hole before you publish it. Past that we can't promise to stay quiet.

We reply within 5 days, and aim to fix serious holes within 30. We tell you when it's fixed.

There's no cash reward yet. Zaisma is small, and we'd rather say so than promise what we can't pay.

A game that breaks the rules, or anything about children's safety, goes to safety@zaisma.com, not here. Copyright is on the DMCA page.