Reporting a security issue.

If you have found a vulnerability in MagmaRouter, thank you. Please report it privately so it can be fixed before anyone else finds it.

How to report

  1. Sign in at the chat. A free account is enough.
  2. Open the account menu and choose Report a bug.
  3. Start the report with the word SECURITY, then describe the issue, how to reproduce it and what an attacker could do with it.

Reports go straight to the operator and are read within two business days.

In scope

  • magmarouter.com and its pages
  • The API at api.magmarouter.com, including keys, spend caps and billing
  • Sign-in, sessions and the account dashboard

Please do not

  • Access, change or delete data that is not yours, or test against other people's accounts.
  • Run denial-of-service or load tests, or spam sign-up and sign-in.
  • Report what a model says. The models answer without refusing by design; that is the product, not a vulnerability.

Machine-readable details are in /.well-known/security.txt.