Security reporting

How to report

Email [email protected] with “Security report” in the subject line. Include enough information to reproduce and assess the issue:

• the affected URL, feature, and approximate time observed;
• a concise description of the behavior and potential impact;
• reproduction steps, screenshots, or a minimal proof of concept;
• any actions already taken; and
• a safe way to contact you for follow-up.

Good-faith research guidelines

To keep research safe and proportionate, please:

• avoid accessing, changing, retaining, or sharing another person’s data;
• stop testing and report promptly if you encounter non-public data;
• avoid denial-of-service activity, destructive testing, malware, persistence, spam, social engineering, and physical attacks;
• use the minimum requests and data needed to demonstrate the issue;
• do not test third-party services, infrastructure, or accounts without their permission; and
• allow a reasonable period for investigation before public disclosure.

Scope

This policy covers this public company website and other systems only when Explore AI Inc. expressly identifies them as in scope. Third-party hosting, email, social platforms, competition sites, and other providers are governed by their own security policies.

Photon47 may include different components and dependencies. If you are unsure whether a game-related issue is in scope, send a non-invasive report first and wait for guidance.

What to expect

We will make a reasonable effort to acknowledge actionable reports, investigate based on severity and available information, and coordinate about remediation or disclosure when appropriate. We cannot promise a specific response time, fix, payment, public credit, or bounty. Duplicate, purely theoretical, automated-only, spam, or out-of-scope reports may receive limited follow-up.

Good-faith treatment

When research is conducted in good faith, stays within these guidelines, and is reported promptly, we do not intend to pursue a claim against the researcher for that activity. This statement does not authorize violation of law, create immunity from actions by others, or bind third parties. If you are uncertain, ask before testing.

Urgent safety concerns

Do not use this inbox for emergencies. If there is an immediate threat to life or physical safety, contact the appropriate local emergency service first.