Security
Found a security problem in something Lotus Mundi built? Send it to security@lotusmundi.com.
That address goes to James J. Tolton. There is no other reporting channel yet, and a public issue tracker is the wrong place for this in any case. Machine-readable contact details are at /.well-known/security.txt.
What to send
The affected URL or version, a description of the problem, and enough detail for someone else to reproduce it. A proof of concept shortens the round trip considerably. Tell us how you would like to be credited, or say if you would rather not be.
What is covered
lotusmundi.comand its subdomains- Silk by Lotus Mundi, and the Lilinaut plugin for Rider, from the day either is published
Lotus Mundi is one person working evenings. The published surface is small today and will grow. If you are unsure whether something belongs to us, ask before you test it.
What is not
Anything below will be read and closed without a reply. This list exists so that you do not spend an afternoon on something we have already decided about.
- Scanner output with no demonstrated impact
- Missing security headers, cookie flags or TLS cipher preferences, with no working attack built on them
- SPF, DKIM and DMARC policy opinions
- Rate limiting on endpoints that neither send mail nor authenticate
- Clickjacking on a page that has no state-changing action
- Self-XSS, and anything that needs the victim to paste code into a console
- Social engineering of anyone connected to the studio, and physical attacks
- Denial of service, load testing, and any probe that degrades the site for other people
- Vulnerabilities in third-party services we merely use, which belong to those vendors
What happens next
Acknowledgement within five business days. An assessment, with a fix or a reason there will not be one, within thirty days of that. Reports arriving in the week around a conference talk will be slower, and the acknowledgement will say so.
Please give us ninety days before publishing, or until a fix ships if that comes first. If ninety days pass and the problem is still open, publish anyway. A deadline you cannot enforce is not a deadline.
Testing safely
Safe harbour. Research carried out in good faith under this policy is authorised, and we will not pursue or support legal action over it. If a third party brings a claim about work you did within these rules, we will make it known that you were acting with our permission.
Staying inside the rules means using only accounts you own or have been given, stopping as soon as you have proved a problem exists, and not reading, changing, saving or destroying anyone else's data. If you reach data that is not yours, stop and tell us what you reached. Do not sit on it.
It also means leaving the service running for everyone else. Do not degrade, interrupt or overload it, and do not interfere with anyone else's use of the site, the tools or the games, or with our ability to do business. Denial of service, load testing and automated scanning heavy enough to be felt by other people are outside this policy. If you cannot show a problem without taking something down, describe it and we will reproduce it ourselves.
There is no bounty
No money is paid for reports. The studio has no revenue yet. What is on offer is a fast answer from the person who wrote the code, and credit on this page if you want it.
This policy was last updated on 7 September 2026. The contact record at /.well-known/security.txt expires on 6 September 2027 and is renewed annually.