Security: reporting a vulnerability

English translation of the French version 0.9.

Version 0.9 of 14 October 2026, during the Alpha.

The essentials

• Found a security vulnerability in the game, the launcher, the site or our servers? Write to support@afterlife-game.com.
• Do not exploit it, and do not make it public before it is fixed.
• A report made in good faith is never sanctioned.

---

1. How to report it to us

1.1 Write to support@afterlife-game.com, in French or in English, with “Security vulnerability” in the subject. Tell us what you found, how to reproduce it, and what an attacker could do with it. Attach whatever helps to understand it: the steps, a screenshot, the versions of the launcher and of the game.

1.2 Attach no password and no data of another player.

---

2. What we ask of you

2.1 The licence agreement (article 16) sets the rule: do not exploit the vulnerability; do not disclose it before it is fixed nor, at the latest, before ninety days after your report; do not consult, copy or modify any data beyond what is strictly necessary to demonstrate it. If you access the data of other players by accident, stop and report it.

2.2 For your tests:

• test the vulnerability only with your own account;
• do not test the third-party services we use (OVHcloud, Discord, PayPal, Buy Me a Coffee…): their vulnerabilities are reported to them;
• do not try to overload or interrupt the service;
• do not target the team or the players, for example with a fake message asking them for their password.

---

3. What we commit to

3.1 We acknowledge receipt of your report within seven days, and keep you informed of its fix (licence agreement, article 16.3).

3.2 Reporting a vulnerability in good faith, following these rules, is never sanctioned: we take no moderation measure against you, and bring no action on that ground (licence agreement, article 16.2).

3.3 We do not offer any financial reward for a report.

---

4. Ordinary bugs

4.1 A bug that does not affect security is reported through the means shown in the launcher or on the game's Discord server. Do not exploit a bug that gives you an advantage: the terms of use forbid it (article 9).

---

5. For tools

5.1 This information is also published, in machine-readable form, at the address /.well-known/security.txt of the site (the RFC 9116 standard).

---

6. Changes to this page

6.1 Each version of this page is dated and remains available on the site, along with the previous ones.