Found a real security hole in NULLWIRE? We want to hear about it. Follow the rules below and you're helping, not attacking, and we won't take any legal action against you.
How to report
Email security@nullwire.org with:
- what the problem is and where (page or request);
- the steps to reproduce it;
- what an attacker could do with it.
You can report anonymously if you prefer. You'll find the same contact in our security.txt.
The rules
- Only test against your own accounts. Make extra test accounts if you need them.
- Don't look at, change or delete other players' data. If you come across someone else's data, stop, don't keep a copy, and tell us.
- Prove it, don't exploit it. Do only what you need to show the problem. Don't stay in the system or plant anything.
- Don't disrupt the site: no denial of service, no high-volume automated scanning, no spam, and don't ruin games for other players.
- No social engineering (phishing, tricking people) and no physical attacks.
- Keep it confidential until it's fixed, or for up to 90 days after your report, whichever comes first. Don't share it with others in the meantime.
What we promise
- We reply within 7 days and keep you updated until it's fixed.
- If you follow these rules in good faith, we won't report you to the police or take legal action against you.
- We'll credit you by name or handle once it's fixed, if you want.
- This is a free fan project, so there's no cash bug bounty. You do get our eternal respect.
Not a vulnerability
- The publishable Supabase key and the game rule files (
breach-core.js,deck-core.js,duel-core.js). These are public on purpose. Show us that they let you do something you shouldn't, though, and that counts. - Bugs in Supabase, Cloudflare, Netlify or jsDelivr themselves. Please report those to the company concerned.
- Missing "best practice" headers or settings that don't lead to a real attack.
- Players who are simply very good. Suspected cheaters go to reports@nullwire.org: that's moderation, not security.
The fine print
This policy gives permission only for testing that follows the rules above, and only on this site: the pages here and the NULLWIRE backend they talk to. It does not cover our providers' own systems. The hacking in the games is fiction. Future CTF Ops challenges will have their own rules about what you may attack.