security

Draft for legal review. Not yet reviewed by a lawyer. Do not publish as final until reviewed. Last updated: 10 November 2026.

Report a vulnerability

Effective date: [Effective date].

If you find a security issue in Dusk Bot, email [email protected]. This policy is offered by [Legal entity name], at [Registered address]. You can find security.txt at https://dusk.bot/.well-known/security.txt.

Scope

You may report vulnerabilities affecting dusk.bot, app.dusk.bot, link.dusk.bot, the Dusk Bot desktop and phone apps, and the VPS installer.

Denial of service, social engineering and third-party providers are out of scope. Report issues in an AI provider, payment service or other third-party system through that provider's own process. This policy does not authorise testing their systems.

What to include

Give your report a clear subject and include:

• The affected app, domain or installer, including version and platform where relevant.
• A short description of the issue and the impact you believe it has.
• Steps to reproduce it using your own account or an isolated test environment.
• A minimal proof of concept, with secrets and personal data removed.
• Your contact details and any disclosure timing you propose.

Do not send passwords, API keys, session tokens, private messages or other people's information. If evidence contains sensitive data, describe what it shows and ask how to share it safely.

Good-faith research and safe harbour

We offer safe harbour for good-faith research that follows this policy. We will not pursue legal action against you for research within this scope that avoids privacy violations, data destruction and service disruption. This commitment covers our own rights and actions. It cannot bind another provider or a public authority.

Test only accounts, devices and data you own or have explicit permission to use. Do not test against other users' accounts. Do not access, change, copy or delete their data. Do not send spam, deceive people or interrupt services. If you encounter someone else's information unexpectedly, stop testing and report the issue without retaining or sharing that information.

What you can expect

We aim to acknowledge your report within [3 business days]. We will assess the issue and communicate with you about findings and next steps. Acknowledgement is not a promise of a fix by a particular date. Please coordinate public disclosure with us so we can address the issue without exposing users.

There is no public bug bounty yet. This policy does not promise payment or another reward. For vulnerability reports and follow-up, use [email protected]. For general enquiries, use [email protected].