security policy.
If you found a vulnerability in anything we publish, we want to hear about it before anybody else does.
how to report
Email support@voiddo.com with the subject line "Security vulnerability report". There is no separate security inbox. Please include what is affected, the steps to reproduce it (the simpler the better), what you think the impact is, and a name if you want credit when it is fixed.
in scope
- voiddo.com and the subdomains we operate, including data.voiddo.com and utils.voiddo.com.
- The packages we publish under the @v0idd0 scope on npm and the repositories in the voidd0 GitHub organisation.
out of scope
Services we do not run: Apify, GitHub, npm, our hosting provider and our payment provider. If the bug is in one of them, report it to them. Also out of scope: social engineering, physical attacks, denial of service and automated scanning that knocks a service over.
safe harbour
If you act in good faith, test only against your own data, do not read or change other people's data, do not exfiltrate more than you need to show the problem, do not destroy anything, and report to us before publishing, we will not take legal action against you.
what we do not have
No paid bounty, no security team and no formal audit. We are a small studio. We read reports and we fix real problems, and we will credit you if you want it.
machine readable
The security.txt file points to the same address.