Vulnerability disclosure

Scope

This covers Darky's production surfaces:

• darky.me and darkyhub.xyz — the public site, dashboard, and staff portal
• api.darky.me — the backend API
• The Darky Discord bot itself

How to report

Email security@darky.me with what you found. This is also the contact published in our security.txt file (RFC 9116). Please don't report vulnerabilities on Discord or other public channels.

A useful report includes:

• Steps to reproduce the issue
• The affected URL, endpoint, or component
• What the impact is (what an attacker could actually do)
• Any proof-of-concept needed to demonstrate it

What to expect

Darky is run by one person, not a security team, so responses aren't on a formal SLA — but real reports get read and acted on personally, and I'll reply to acknowledge your report as soon as I can. If a fix is needed, I'll let you know once it's deployed. There's no bug bounty program at this time.

Good-faith research

If you're testing in good faith — avoiding data destruction, privacy violations, and service disruption, and reporting promptly rather than exploiting what you find — I won't pursue legal action over the research itself. Automated mass-scanning or denial-of-service testing against production is not okay; if you need to test something disruptive, ask first at the email above.