Security Disclosure Policy

The safety of our community, systems, and users is one of our highest priorities. This covers how we handle vulnerability reports, and the strict boundaries around testing Sway's bot, API, and website infrastructure.

Unauthorized testing is strictly prohibited

No one may test Sway's systems without our written sign-off.

Under no circumstances may any user or third party do any of the following:

Penetration testing or vulnerability scanning
Token or API abuse
Bot or dashboard exploit attempts
Social engineering, including against Discord staff or users
Any unauthorized data access or tampering

All testing has to be formally authorized by Sway, in writing, before it happens.

Important

Unauthorized testing or exploitation leads to a permanent blacklist, and may lead to legal action.

Responsible disclosure

Found something? Here's how to report it.

If you think you've found a security issue in Sway, its dashboard, or a connected service, report it responsibly and privately.

All reports go through our Support Server. Include:

A clear description of the vulnerability
Steps to reproduce it
The affected URLs, endpoints, or bot features
A non-destructive proof of concept, if you have one
Your Discord username, so we can follow up

Note

Hold off on disclosing anything publicly until we've confirmed the issue is fixed and cleared you to share it.

Our response process

We review every report on a best-effort basis, prioritized by risk and impact.
If you give us contact details, we may follow up with updates while we investigate.
We evaluate next steps per incident - severity, intent, and whether our policy was followed all factor in.

Recognition and rewards

We notice the people who help us stay secure.

We value the effort that goes into a responsible report. Reporters may get acknowledgment in community updates or changelogs.

Any reward or recognition is entirely at our discretion. Sway doesn't run a guaranteed public bug bounty unless we've explicitly announced one.

Good to know

We appreciate every responsible contributor who helps keep Sway secure.

Abuse and malicious exploitation

What happens if a vulnerability gets used to cause harm.

If a vulnerability is found and then used against our services, users, or systems - including:

Data scraping or unauthorized viewing
Manipulating bot commands or internal APIs
Leaking data or tokens
Impersonating Sway staff or services

Sway can terminate access, blacklist every account involved, and pursue legal action.

Caution

Stumbling onto something by accident isn't punished if you report it immediately and don't access or misuse any data.

Public disclosure

We may publicly summarize a resolved vulnerability, and credit the reporter with their permission.
We never publish exploit details that could put users or systems at risk.

Authorised testing

For contracted or formally approved testers only.

If you're formally contracted or authorized to test Sway, coordinate everything through our security contacts in the Support Server.
You may not access private data, modify services, or disrupt operations under any circumstances.

This document can change at any time, with or without notice.

Loading your experience...