Found a security problem? Tell us.

Email security@cognivo.digital. Please include enough for us to reproduce it: the URL or endpoint, the steps, and what you saw happen. A proof-of-concept request or a short recording helps more than a scanner report does.

Please do not open a public GitHub issue for a security problem. Everything else about this project is public, but a report should be private until there is a fix.

The site at cognivo.digital, the game API at api.cognivo.digital, and the source in the public repository. Anything that lets someone read or change another player's game, run code in another visitor's browser, reach the server host, or take the service down is worth reporting.

Out of scope: findings that only affect the third-party services Cognivo uses — report those to the vendor. Missing hardening headers, weak TLS configuration, or the absence of rate limiting, with no demonstrated impact. Reports produced entirely by an automated scanner with no verification. Social engineering, physical attacks, and anything requiring access to a player's device.

Cognivo has no accounts, no passwords, and no stored personal data, so whole classes of report do not apply here. See the Privacy Policy for what actually exists.

Test against your own games only. Do not access, modify, or delete data belonging to anyone else — if a bug would let you, stop there and describe it rather than proving it at another player's expense. Do not run denial-of-service or high-volume automated testing against the live service; it is one small server and you will simply take the site down for other people.

Give us a reasonable chance to fix the problem before publishing. If you tell us you intend to disclose, we will tell you honestly whether the timeline is realistic rather than negotiate for silence.

An acknowledgement within 5 working days, and an assessment — whether we agree it is a vulnerability, and roughly when we expect to fix it — within 10 working days. If a report turns out to be out of scope or not a vulnerability, we will say so plainly and explain why.

This is a solo, unfunded project, so there is no bug bounty and no payment. What we can offer is credit: if you would like it, and the report was valid, we will name you on the Acknowledgements page once the fix has shipped.

If you follow this policy in good faith, we will not pursue or support legal action against you for your research, and we will treat your work as authorised under the computer-misuse laws that would otherwise apply. If someone else brings action against you for research that stayed within this policy, we will make clear that it was authorised.

This is an intent, stated by an individual rather than a company, and it cannot bind third parties — the hosting provider and the other services Cognivo depends on have their own terms. If you are unsure whether something is in bounds, ask first at security@cognivo.digital and we will answer.