Vulnerability Disclosure Policy

§1 Disclosure program, not a bug bounty #

Frost runs a vulnerability disclosure program: a way to report security problems safely and have them fixed. Frost does not run a paid bug bounty and does not promise payment, rewards or swag for reports. With your permission, we will credit you when we publish a fix.

§2 In scope #

• frostclient.xyz, including accounts, sign-in, Discord linking, checkout, the account page, Bazaar statistics and the download route.
• The Frost license service the client contacts.
• market.frostclient.xyz.
• Official Frost client builds downloaded from your account, for vulnerabilities that put users at risk: remote code execution, data exposure, unsafe network handling, insecure local storage of credentials.
• The Frost Discord bot's own behaviour, such as permission or command flaws.

§3 Out of scope #

• Discord, NOWPayments, Cloudflare, GitHub, Google, the server host, Hypixel, Mojang or Microsoft systems. Report those to the company concerned.
• Ways to bypass Frost's license checks or anti-piracy measures to use the client without a valid license. You may report them, but researching them does not give you a right to use, publish or distribute a bypass, and the EULA still applies.
• Whether Frost can be detected by Hypixel or other servers.
• Findings with no realistic security impact: missing headers that do not enable an attack, banner or version disclosure, self-XSS, clickjacking on pages without sensitive actions, logout CSRF, or reports produced only by automated scanners.
• Rate-limit thresholds that do not enable an attack.
• Social engineering of Frost staff or users, phishing, and physical attacks.

§4 Rules for testing #

• Use only accounts you own, or accounts whose owners have given you explicit permission.
• Do not access, change, copy or delete other users' data. If you reach someone else's data by accident, stop, do not keep it, and tell us what you saw.
• Do not run denial-of-service tests, high-volume scanning, brute-force attacks or anything that degrades the service for others.
• Do not make real payments to test checkout beyond your own purchases, and do not tamper with other people's orders or licenses.
• Do not use exploits to keep access, move further into systems, or install anything.
• Do not exfiltrate data. Use the minimum access needed to show the problem.
• Keep the vulnerability confidential until it is fixed or the disclosure date we agree has passed.
• Follow the law where you are.

§5 How to report #

Open a support ticket in the Frost Discord server and say it is a security report; only you and Frost staff can see a ticket. Do not post details in public channels. Please include:

• what the vulnerability is and where (URL, endpoint, client version);
• step-by-step instructions to reproduce it, with requests, screenshots or a short video;
• the impact you think it has;
• whether any data of other people was accessed;
• how you would like to be credited, if at all.

Do not include other people's personal data in the report beyond what is needed to show the problem.

§6 What you can expect from us #

• We acknowledge your report within 5 business days.
• We confirm whether we can reproduce it and keep you informed while we fix it.
• We treat your report and your identity as confidential and do not share them without your permission, unless the law requires it.
• We tell you when it is fixed.

§7 Coordinated disclosure #

We ask you to wait until the problem is fixed before publishing, and no longer than 90 days from your report unless we agree a different date together. If a vulnerability is being actively exploited, we may publish sooner. If we need more time for a complex fix, we will explain why and agree a new date with you.

§8 Safe harbor #

If you make a good-faith effort to follow this policy, we consider your research authorised. Frost will not bring legal action against you or report you to law enforcement for it, including under anti-hacking laws or under the anti-circumvention and reverse-engineering terms of the EULA, to the extent your research was needed to find and report the vulnerability and you did not use or share what you found for anything else.

This safe harbor covers only Frost's own claims. It cannot authorise testing of systems owned by others, such as Discord, Cloudflare or Hypixel, and it does not bind them. If a third party brings legal action about research you did under this policy, we will make it known that your research was authorised by Frost. If you are unsure whether something is allowed, ask us first.