Security
If you think you have found a security issue in Statewide, tell us. We would rather hear it from you first.
Reporting an issue
Email security@statewide.gg with what you found, the steps to reproduce it, and what an attacker could do with it. Include the URLs, community slugs or request IDs involved. Please do not include other people's personal data beyond what is needed to show the issue.
What we commit to
- We acknowledge every report within 48 hours.
- We reproduce the issue before making any public statement, and we never deny a report before reproducing it.
- Every confirmed issue gets a published fix note that tells community owners which rotation to perform, if any: an API key, a Discord webhook or a department join code.
Scope
In scope: statewide.gg, app.statewide.gg, api.statewide.gg, and community sites served by Statewide on custom domains.
Out of scope: denial of service and load testing, social engineering of staff or community members, physical attacks, and third-party services we use (report those to the vendor). Community game servers and their own resources are run by each community, not by Statewide.
Testing in good faith
Test only against accounts and communities you own or have permission to test. Stop and report as soon as you can read data that is not yours, and do not keep it.