Report a vulnerability privately

Reporting channel

Send reports to sikora@splatfiction.comwith the subject “Splatfiction security report.” Include the affected URL or feature, reproducible steps, impact, and only the minimum evidence needed. Do not include source photos, credentials, or another person's personal data.

There is no bug-bounty or reward program and no guaranteed response or resolution time.

Testing boundary

Only minimal, non-disruptive validation using devices, accounts, and data you control is permitted. This page does not authorise access to another person’s data or account, circumvention of access controls, service disruption, retention of non-public material, or violation of third-party rights or applicable law.

Not authorised

• denial of service, load testing, high-volume automated scanning, or resource exhaustion;
• social engineering, phishing, physical attacks, or attacks on providers;
• accessing, changing, retaining, or sharing another person’s data;
• publishing an unresolved vulnerability, exploit, credential, proprietary code, or non-public know-how;
• extortion, destructive testing, persistence, or lateral movement beyond a minimum proof.

Scope and protected information

This reporting channel covers the first-party Splatfiction beta at splatfiction.com. Vulnerabilities in a third-party provider should be reported to that provider unless they arise from the beta’s own configuration. Reporting does not grant a licence to copy, retain, disclose, redistribute, or commercialise proprietary material.

Internal architecture, controls, configuration, calibration, source material, and implementation know-how are deliberately not published.

Private disclosure

Report privately before any disclosure and allow a reasonable opportunity to investigate. Do not publish material that would expose users, credentials, personal data, proprietary code, or non-public implementation details.