If you find a security problem in Dark Future, please tell us. Reports
made in good faith under the rules below are welcome, and nobody will be
pursued for making one.
1. How to report
Send a message through the contact form, and include:
what the problem is, and what an attacker could do with it;
the exact steps to reproduce it: URLs, requests, screenshots;
the date and time you tested, and the account you used, if any.
If the report itself is sensitive, say so and keep the detail brief until
a private channel is agreed.
2. What is in scope
The website at dark-future.co.uk and anything
served from it.
3. What is not
Denial of service, flooding, or anything that degrades the game for
other players.
Spam, phishing, or social engineering of players or the operator.
Physical attacks, or anything against the hosting provider.
Reports that are only the raw output of an automated scanner, with
nothing showing the issue is real.
Missing hardening headers or best-practice warnings with no
demonstrable impact.
4. What we ask of you
Use only your own accounts, or ones you have been given for testing.
Access the smallest amount of data needed to show the problem is
real, and stop there. If you come across somebody else's personal
data, stop, do not save it, and say so in your report.
Do not change or delete anything that is not yours, and do not
degrade the service.
Give a reasonable amount of time for a fix before telling anybody
else. This is a one-person project, so 90 days is the guide.
5. What you get back
An acknowledgement as soon as the report is seen.
An honest answer about whether it will be fixed, and roughly when.
Credit on this page if you want it, and none if you would rather
stay anonymous.
There is no bug bounty. This is a free game run by one person and there
is no money behind it. Said plainly, so nobody spends a weekend
expecting otherwise.
6. Safe harbour
Research that follows the rules above is authorised, and no legal action
will be taken over it. If you break something by accident while acting in
good faith, say so. That is treated as part of the report, not as
an attack.