Security & Responsible Disclosure

Report a suspected vulnerability privately to security@kovex.gg. Include the affected product, reproduction steps, impact, and any proof of concept that can be shared safely. Do not include customer secrets or personal data unless Kovex provides a secure transfer method.

Our Terms of Service require responsible disclosure instead of probing, scanning, or exploiting systems without authorization.

Reports concerning Kovex web properties, APIs, launcher, Client runtime, plugin marketplace, build and publication pipeline, or signed update channel are welcome. Third-party services and developer plugin behavior that does not cross a Kovex security boundary should be reported to the relevant provider, but Kovex may coordinate when marketplace users are affected.

Kovex will not pursue action against good-faith research that:

• Avoids privacy violations, data destruction, service degradation, social engineering, physical attacks, and access beyond what is needed to demonstrate the issue
• Uses accounts and data you own or have explicit permission to test
• Stops and reports promptly after discovering sensitive data or a path to customer impact
• Keeps vulnerability details private while remediation is in progress
• Complies with applicable law

This policy does not authorize testing against third-party infrastructure or accessing another person’s account or data.

• Acknowledge reports within about two business days
• Provide an initial triage assessment within about five business days
• Share remediation progress for validated issues
• Critical issues affecting authentication, signing, plugin publication, customer credentials, payments, or remote code execution receive immediate incident handling

Timelines may vary with complexity. Kovex coordinates public disclosure after affected users are protected and a fix is available. Please do not publish before a mutually agreed disclosure date.

See also our Legal hub, Terms of Service, Privacy Policy, and Support.