Security
Reporting a vulnerability
If you believe you have found a security problem in Andromeda, please tell us privately so we can fix it before it is made public.
How to report
Email security@andromedasphere.com with a description, the steps to reproduce it and its impact. Encrypt sensitive details if you can.[1]
What we commit to
- We acknowledge every report within 72 hours.[1]
- We keep you updated as we work towards a fix.[1]
- We will not pursue legal action for good-faith research that follows this policy.[1]
- With your permission, we credit you once the issue is resolved.[1]
In scope, and what not to do
The Andromeda web app and its APIs are in scope. Please do not run automated scanners that degrade the service, access or change other members' data, attempt social engineering or physical attacks, or test denial of service. Test only against your own accounts.[1]
Something wrong with this website itself? Write to contact@persephonereborn.com.
A machine-readable version is at /.well-known/security.txt.