Security policy
How to report a security problem in Mizan, what we do with your report, and the research we allow.
Last updated .
What it covers
Tell us about anything that could let someone reach data or powers they shouldn't have in:
- mizan.ac, including sign-in, community dashboards and the MCP server at mizan.ac/mcp
- the Mizan API at api.mizan.ac
- the Mizan server module and the loader that starts it, which communities install on their game servers
- the detection service the module connects to
For example: reading another community's dashboard, signing in as someone else, using a server key you don't hold, crashing a game server through the module, or changing what Mizan reports about another player.
What it doesn't cover
- Denial of service, load testing or flooding anything
- Social engineering, phishing, or physical access to anyone's equipment
- Sending spam, including through our sign-up and sign-in emails
- Cheats: building or testing one, getting one past Mizan's detection, or evading a ban. None of these is a vulnerability under this policy, and we don't authorise any of them.
- Bans on communities' lists. To dispute one, see disputing a ban.
- Game servers, websites and Discord servers that communities run, other than the Mizan server module itself
- Services we use, such as Cloudflare, Steam and Discord. Report problems in those to the service.
- Scanner output with no working attack behind it
How to report
Email contact@mizan.ac with a subject that starts with "Security:". Please include:
- what you found and where: the address, the API route, or the module's version and the game server's operating system
- the steps that show it, and what you saw
- what an attacker could do with it
- whether you'd like to be credited, and under what name
Write in English if you can. Send only what you need to show the problem, and no one else's personal data. We don't run a bug bounty, and we don't pay for reports.
Tools that look for a security contact will find the same address in our security.txt.
What we'll do
- Confirm we have your report within three working days.
- Tell you within ten working days whether we can reproduce it and how serious we think it is.
- Keep you updated at least every 14 days until it's fixed.
- Tell you when it's fixed, and credit you if you'd like us to.
Publishing what you found
Give us 90 days from your report to fix the problem before you publish anything about it. If we fix it sooner, we can agree an earlier date with you. If we need longer, we'll tell you why before the 90 days are up and agree a new date.
A fix to the server module only protects a community once it installs the new version, so we may ask you to leave out details that would still work against older versions. If a problem is being used against communities, we may warn them before then, and we'll tell you first.
Research we allow
If you act in good faith and follow this policy, we treat your research as authorised. We won't take legal action against you or report you to the police for it, and if anyone else does, we'll say publicly that it was authorised.
That includes reverse engineering, decompiling, disassembling and testing the Mizan server module on a game server you run, as far as you need to find and show a security problem. The restrictions in the module's licence in our terms of use don't apply to research done under this policy.
Acting in good faith means:
- testing only with your own accounts, your own community and your own game servers
- not opening, changing or keeping anyone else's data. If you reach some, stop, tell us, and delete it.
- not slowing down or breaking Mizan, or anyone's game server, for other people
- using what you find only to report it to us, and not sharing it until we've agreed you can publish
- not giving copies of the module to anyone else
We can only authorise access to our own systems. Our providers, and the communities that run game servers, aren't bound by this policy. If you're not sure whether something is allowed, ask us before you try it.