Found something that needs fixing?

What helps us investigate

Include the affected route or feature, a clear description of the issue, safe steps to reproduce it using your own test profiles, and the likely impact. Screenshots or a minimal proof of concept can help. Redact player data, device cookies, sign-in links, authenticator keys, recovery codes, linking codes, and push subscription endpoints.

Keep other players safe

Use only devices, accounts, and content you control. Stop if you encounter someone else’s private data. Do not run denial-of-service tests, mass scanning, social engineering, or attempts to access the hosting provider or other tenants. Coordinate public disclosure so the issue can be investigated and addressed.

This page provides a reporting channel, not authorization to access other people’s data or a promise of a bounty or legal safe harbor.

Protect your account

Use a passkey and optionally an authenticator app in Your account. Keep your recovery codes somewhere private and safe. Email links are single-use; only continue if you requested the link. Review signed-in devices and sign out sessions you no longer recognize.

Two-factor protection also applies after email sign-in. If you lose the authenticator, use a saved recovery code. Administrators cannot reveal your credentials or turn off your two-factor protection from the dashboard.

Protect your guest progress

A device-link code gives another device access to your player profile. Keep it private, cancel unused codes, and remove unfamiliar linked devices in Settings › Link a device. Do not send your session cookie to anyone, including in a bug report.

Machine-readable contact information is available at security.txt.