Security fixes target the current main branch and the production site at sleepy.land.

Use GitHub’s private vulnerability reporting for hraness/sleepyland when it is available. Otherwise email ben@substrate.run with the subject Sleepyland security.

Include the affected route or component, impact, reproduction steps, and any safe proof of concept. Do not include credentials, unrelated personal data, private browsing history, medical information, or destructive test results.

Please do not open a public issue, publish an exploit, access another person’s data, degrade the service, or test third-party providers without authorization. The maintainer will assess reports in good faith, coordinate a fix when one is warranted, and credit reporters who want attribution. No response-time or bounty promise is made.