Report a security issue

If you discover a security issue affecting the Pinionfall Engine, its free game or this storefront, email support@pinionfall.com with “Pinionfall security report” in the subject.

What to include

• The affected release, component or page, and when you observed the issue.
• A short description of the possible impact and any signs of exploitation you observed.
• Steps to reproduce it using your own local copy and test data, where possible.
• A contact address for questions and coordination.

Keep the initial report to the information needed to assess the issue. Do not include passwords, API keys, payment details, other people's personal data or a complete copy of private source code. If sensitive technical evidence needs to be exchanged, ask us to arrange an appropriate channel first.

Testing and disclosure

Use systems and data you are authorised to test. Testing our live services requires prior written permission under the terms of sale. A security report does not grant permission to access another person's account, disrupt a service or test our providers.

Please report exploitable details privately so we can assess affected versions and coordinate a correction and disclosure. We review reports, investigate their impact and communicate relevant mitigations or corrected releases. Where user action is needed, the security notice will identify affected versions and the steps to take.

Reports and replies are handled as correspondence under our privacy notice. For account access, payment or refund questions, use the same contact address and describe your request.