Security reports
If you find a security problem in GAMPEON, please tell us before you tell anyone else. Write to security@gampeon.com. The same address is in gampeon.com/.well-known/security.txt.
What helps us
Section titled “What helps us”- What is affected: the API, the portal, the MCP server, the Lua sandbox, a game server or something else.
- Steps to reproduce, and what an attacker could do with it.
- Your name or handle, if you want to be credited.
What we ask
Section titled “What we ask”- Only test with your own accounts and data. Do not access, change or delete other people’s data.
- Do not run load tests or denial-of-service attacks against our servers.
- Give us reasonable time to fix the problem before you publish it.
Especially interesting
Section titled “Especially interesting”- Ways to escape the Lua sandbox or break the memory and CPU limits.
- Ways for content (marketplace items, project pages, profiles) to make an AI assistant do things the user did not ask for. See MCP security.
- Access to data or actions beyond what a token’s scopes allow.
We answer every report. There is no paid bug bounty yet.