Security

Reporting a vulnerability

If you believe you have found a security vulnerability, please report it privately by emailing [email protected]. Please do not open a public GitHub issue, pull request, or discussion for a security report, since that can expose other users before a fix ships.

Include what you can: a clear description, reproduction steps, the potential impact, and any relevant logs, screenshots, or proof-of-concept. A suggested fix is welcome but not required.

What to expect: AO-SAGE is run by a single operator. We aim to acknowledge a report within a few days, investigate and fix on a best-effort basis prioritised by severity, and keep you informed of progress where reasonable.

Scope

In scope:

• the AO-SAGE web app and its API at this domain (authentication, account data, uploads, webhooks, rate limiting, and the like);
• the AO-SAGE companion desktop app, to the extent it talks to our servers.

Out of scope:

• Albion Online itself and Sandbox Interactive GmbH's own systems - AO-SAGE is an independent fan project, not affiliated with, endorsed by, or sponsored by them;
• third-party services we depend on but do not operate - Discord (OAuth sign-in), Cloudflare, and render.albiononline.com - please report those upstream;
• volumetric denial-of-service testing, spam, or social engineering against us or other users.

Good-faith research (safe harbour)

We will not pursue or support action against a researcher who, in good faith, discovers and reports a vulnerability through the private channel above, provided they avoid privacy violations, service degradation, data destruction, and disruption to other users. Please test only against your own account and data, and do not access, modify, or retain data that is not yours.

No bug bounty

To be direct about it: AO-SAGE does not run a bug bounty program and cannot offer monetary rewards. We are genuinely grateful for responsible reports and happy to credit you if you'd like - that's the extent of what we can offer.

Current security posture

Some things already true about how this runs, for context:

• Rate limiting is default-on for both authenticated and anonymous requests, keyed by identity (signed-in user, device key, or IP as a fallback) rather than IP alone; a small set of static-asset and machine endpoints (health checks, release downloads) are exempt so legitimate automation isn't broken.
• Screenshot uploads are checked against their actual binary signature, not just the filename or the browser-declared file type, before anything downstream processes them.
• Sessions and account permissions are read fresh from the database on every request; there is no permission cache that could serve a stale or revoked grant.
• Service-to-service traffic (inbound data ingest, outbound webhooks) is authenticated with a per-connection secret and an HMAC signature over a timestamped body, so a captured request can't be replayed later.
• The database and job queue are only reachable from other AO-SAGE services on an internal network - never directly from the internet.
• The companion desktop app never modifies, injects into, or automates the Albion Online client. Where it reads game data, it only passively reads network traffic on your own device, read-only.

Status

There is no /status page on this domain, deliberately: a status page hosted on the same box as the app is unreachable at exactly the moment it would matter. See infra/README.md (Status page - decision) for the reasoning and the real options if one gets built.