Report a Security Issue

Email security@tav.gg and include:

• what you found and where, with steps we can follow to reproduce it;
• what you think someone could do with it;
• the app and version, or the web address, plus your device and browser if they matter;
• any screenshots, requests, or proof of concept that help us see it.

Please do not include other people's data in your report. If you saw some while showing the problem, describe what you saw instead of sending it.

If you need to send us something sensitive, say so in your first email and we will agree a safe way to share it.

Anything we run, including:

• the tav.gg and wondersofaether.com websites;
• our APIs and live connections: api.tav.gg, api.wondersofaether.com, ws.tav.gg, and ws.wondersofaether.com;
• files we serve from cdn.tav.gg;
• the Taverns apps for Windows, Mac, Linux, iPhone, and Android;
• Taverns for OBS;
• Wonders of Aether.

Not sure whether something counts? Send it anyway. We would much rather hear about it.

Please do not try these. Some of them hurt real people:

• social engineering or phishing of our team or the people who use Taverns;
• physical attacks on our offices, people, or equipment;
• denial of service, load testing, or anything else that slows or breaks the service for others;
• spam, or messages to people who did not agree to take part.

We also cannot act on automated scanner output alone. Please show what someone could actually do with the issue.

A bug in a service another company runs for us belongs with that company, so please report it to them. How we set those services up, such as who can read our files or data there, is in scope.

If you make a good-faith effort to follow this policy, we will not pursue legal action against you or ask law enforcement to act against you for your research.

Good faith means you:

• test only with your own accounts, or with accounts whose owners have said yes;
• do not change or delete other people's data, and see or keep no more of it than the minimum needed to show the problem;
• stop and tell us right away if you reach personal data, and delete any copies once you have reported it;
• do not slow down, break, or disrupt the service for anyone else;
• do not ask for payment or anything else in return for keeping the issue private;
• give us reasonable time to fix the issue before you share it with anyone else.

We can only speak for systems we run. We cannot give permission to test anyone else's.

• We will confirm we got your report within 3 business days.
• We will keep you updated while we look into it, and tell you when it is fixed.
• If you would like, we will credit you by name once it is fixed. Tell us how.

We do not run a paid bug bounty program right now, so we cannot offer payment for reports.

For a child safety concern, see our Child Safety Standards. To report abuse, harassment, or harmful content, use Report in the app beside the message, profile, post, or Tavern. For account help, email support@tav.gg.

Taverns and Wonders of Aether are operated by MEKASMITH Co., Ltd. in Tokyo, Japan. Our company and contact details are on the Support page.