Security

How to report

• Email security@netherportal3.com. A person reads every email, so use this for anything serious.
• From a tool or script, send the report as JSON in a POST to this address:https://netherportal3.com/api/security/reportOpen it in a browser to see the fields it takes. You get a reference number back once the report is saved. If you do not get one, email us as well.

Keep it private. Do not post a security issue publicly, in a Discord server, or in a support ticket.

What to include

• What the problem is, and what someone could do with it.
• Steps to make it happen again: the request and response, a short script, or a screen recording.
• The page, address or feature where it happens.
• Anything needed first, such as being signed in or a certain setting.
• How to reach you, and whether you would like credit.

A rough report is fine. We would rather hear about a problem early than not at all.

Testing rules

• Only use accounts and data you created yourself.
• Never access, change or delete anyone else's data. If you reach someone else's data, stop at the first record that proves it and report it right away.
• No denial-of-service, load testing or brute forcing.
• No phishing, social engineering, or messages to real people.
• Once you confirm a serious issue, stop there and report it. Do not dig further or combine it with other issues.
• Keep what you find to yourself until we have fixed it and agreed on timing with you.

What you may test

Only the platform's own sites:

• netherportal3.com and www.netherportal3.com
• netherbio.com and www.netherbio.com
• paste.netherbio.com

Every other address is out of bounds. That includes our customers' sites: other names under netherbio.com and customers' own domains. If you notice a problem while simply visiting one, you can still report it.

Before testing in depth, read the full rules of engagement. They also explain how to register, so we can tell your testing apart from a real attack. If this page and those rules ever differ, the rules win.

What happens next

These are our targets, not contractual guarantees:

• Acknowledgment within three business days.
• Triage and an initial severity assessment within seven business days.
• Remediation prioritized by severity; critical issues are worked immediately.
• Credit, with your permission, once a fix has shipped.

Safe harbor

If you act in good faith and follow these rules, we will not take or support legal action against you. Good faith means you avoid privacy violations, data destruction and service disruption, and you give us a fair chance to fix the issue before telling anyone else.

Testing outside the sites listed above, or breaking the testing rules, is not covered. If you are not sure whether something is allowed, email us and ask first.

Not a security issue?

To report a scam, harassment, or a site that breaks our rules, use Report abuse at the bottom of that site instead. The address on this page is only for security issues.

For security tools

The same contact details are published in the standard machine-readable security.txt file.