Security Disclosure Policy
How to tell us about a security problem, and what we promise in return.
- Version 1.0
- Effective October 29, 2026
- For: Security researchers
Reporting a vulnerability
We welcome good-faith security research. If you find a security or privacy vulnerability in any TeamALA property, tell us privately at security@teamala.org. We also publish a security.txt file at teamala.org/.well-known/security.txt.
Please include:
- (a) what you found;
- (b) how to reproduce it; and
- (c) what an attacker could do with it.
In scope
- (a) teamala.org and all its subdomains;
- (b) go.teamala.org short links;
- (c) the Nora by TeamALA bot; and
- (d) the Nora Legacy dashboard.
The rules
- (a) Do not view, change, copy or keep other people's or other communities' data. Test with your own accounts and your own test community.
- (b) Stop as soon as you reach someone else's data, and tell us.
- (c) Do not run denial-of-service attacks, spam or social engineering, and do not attack our providers (Roblox, Discord, Vercel, Supabase, Upstash, Cloudflare, GitHub or Railway).
- (d) Do not use screening to look up real people for testing.
- (e) Give us reasonable time (90 days, unless we agree otherwise) to fix the problem before you talk about it publicly.
Our promise
If you follow these rules in good faith:
- (a) TeamALA Ltd Liability Co. authorises your testing;
- (b) we will not bring a legal claim or make a law-enforcement referral against you under the Computer Fraud and Abuse Act, DMCA section 1201 or similar laws; and
- (c) we will tell you when the problem is fixed and, if you wish, credit you.
We cannot authorise testing of other companies' systems.
What we do
- (a) We acknowledge your report within 3 business days.
- (b) We keep you updated.
- (c) We fix confirmed problems according to how serious they are.
- (d) If personal data was exposed, we follow our breach procedure, including telling the people affected and the authorities where the law requires it.
We do not currently pay rewards.