Vulnerability disclosure
1. Purpose
This procedure says how anyone can tell Landsidu privately about an exploit or a security hole, and what Landsidu does about it. A public post about an exploit lets others use it before it is fixed, so reports are private, and anyone who reports one privately in good faith is never sanctioned by us for finding it (section 7).
2. Scope
| Landsidu's to fix | Not Landsidu's to fix: report it to the maker |
|---|---|
| Landsidu's own mod (Daegred), server scripts and settings | The base games: DayZ (Bohemia Interactive) and Minecraft (Mojang) |
| How our game servers, our Discord and our server computer are set up | Other people's mods: their authors, through their Workshop page or Discord |
| Duplication, map or base exploits on our servers | Discord, Steam or our hosting provider themselves: their own security pages |
If an exploit is in a base game or someone else's mod but can be used on our servers, tell us too, so we can protect our servers while the maker fixes it.
3. Terms
| Term | Meaning |
|---|---|
| Exploit | A bug or trick that gives an unfair advantage or breaks the game, such as duplicating items |
| Security hole | A weakness that could let someone into an account, a server or data they shouldn't reach |
| Reporter | The person who tells us about one |
4. Responsibilities
- The Owner receives every report, decides on the fix and when it happens, and tells the reporter.
- Admins and Moderators acknowledge any report they receive, pass it straight to the Owner, and don't discuss it elsewhere.
5. How to report
- Open a private thread in
report-a-playerwith "Exploit" at the start of the title, or send an Admin a direct message. If you don't use the Discord, email security@landsidu.com. - Say what it is, where (which server or channel), how to reproduce it if you know, and when you found it.
- Stop once you can explain it. Don't use it any further, and don't tell anyone else until we say it's fixed.
6. What we do
- Acknowledge within 24 hours (our target, the same as every report), and tell the reporter who is looking at it.
- Contain it at once if it is being used: for example, pause the affected feature or turn off a setting. Any server restart this needs keeps to the server's own safety rules.
- Fix it through Landsidu's normal change process, with a test first. For someone else's code, report it to the maker and work around it on our side.
- Tell the reporter when it is fixed, and thank them. Credit is given only with their permission.
- Record it as an incident, describing the hole only in general terms until it is fixed.
- Put things right for players: where an exploit changed the game (duplicated items, broken bases), the Owner decides on any rollback or clean-up and announces it in that server's news channel.
7. Good-faith reporters
If you find an exploit, stop once you can explain it and report it privately. You won't be sanctioned by us for finding or minimally demonstrating it in good faith, provided you don't harm anyone, access someone else's data or keep an advantage. Using an exploit for advantage, or not reporting it, is cheating (LS-POL-002).
8. Review
The Owner reviews this procedure every 6 months, and after each report it handles.
Basis: decisions D10 and D57 to D59 in the Landsidu decisions record; LS-POL-001 section 5.2.