Responsible disclosure
Security
Found a real vulnerability in neverlogoff.com or its API? Tell us privately before telling anyone else, and we'll fix it fast and credit you. This page is the machine-readable /.well-known/security.txt (RFC 9116) turned into English.
Report privately
security@neverlogoff.com — encrypt if you can, but a plain email is fine. Include what you found, how to reproduce it, and what you think the impact is. We'll acknowledge within a few business days.
Scope
- In scope: neverlogoff.com, its subdomains, and its public API (
/api/*). - Out of scope: third-party services we link to or integrate with (Twitch, Meteora, Solana RPC providers, DNS registrars) — report those to their own security teams.
Rules
- Never test in a way that moves real funds — no real launches, no real swaps, no draining a real pot. Use a throwaway devnet setup or describe the flaw instead of executing it.
- Never target other users — no social engineering, no attacking a real streamer's account, no touching data that isn't yours.
- No automated scanning that degrades service for others (rate-limit-respecting testing only).
Safe harbour
If you follow this policy in good faith, we will not pursue legal action against you for your research, and we'll treat your report as authorized security testing. We ask the same good faith of you: report privately, give us a reasonable window to fix it, and don't exploit what you find beyond what's needed to demonstrate it.
Disclosure window
We ask for 90 days from your report before any public disclosure, so we have time to ship a fix. We'll keep you updated on progress.
Reward
This is a small, self-hosted project — there's no funded bug bounty program. For a genuine, responsibly-disclosed finding, we offer a small thank-you, at our discretion (public credit, and/or a token amount when the finding materially protects user funds). No promise of a fixed amount, and no reward for findings already known to us or out of scope.
Machine-readable file
Per RFC 9116: