Security policy

If you think you've found a security vulnerability in Rotproof or RotproofBot, please email security@rotproof.dev. Please don't open a public issue.

Include what you found, how to reproduce it and what an attacker could do with it. We'll acknowledge your report within 3 business days and keep you updated until it's fixed.

Please test only against accounts and sites you own, don't access or change other people's data, and give us reasonable time to fix the issue before you share it publicly. We won't take legal action against good-faith research that follows these rules.

If you run a website and want RotproofBot to stop visiting it, see how to opt out.