Security Policy
Keeping Coffee Breach and our players' information safe matters to us. This policy explains how to report a security issue and what is, and is not, permitted.
Security testing of this site is not authorized. Do not scan, probe, attack or penetration-test Coffee Breach.
1. No authorization to test
We do not run a bug bounty or vulnerability research program, and we do not authorize security testing of any kind against Coffee Breach, coffeebreach.com, app.coffeebreach.com and its other domains, servers, APIs, email systems, third-party providers, accounts or people. This includes, without limitation:
- penetration testing, vulnerability assessments, and automated or manual vulnerability scanning;
- fuzzing, brute-forcing sign-in codes, credential stuffing, or attempts to bypass authentication or rate limits;
- denial-of-service, load or stress testing, or anything that degrades the Service for others;
- accessing, modifying or deleting data that is not yours, or other players' accounts;
- tampering with scores, leaderboards, events or game logic;
- uploading files designed to test or attack our file handling, such as malware samples, test virus files, malformed or oversized images, or files disguised as photos;
- scripting the username check or other features to collect information about players;
- using "Suggest an idea" to send spam, attack payloads or messages meant to test or attack our email systems;
- trying to reach admin pages or other players' information, or guessing event codes, join codes, team invite links or challenge links;
- social engineering, phishing or physical attacks against our operators or providers.
Playing the game normally is, of course, welcome. Unauthorized access to or testing of computer systems may violate laws including the U.S. Computer Fraud and Abuse Act (18 U.S.C. § 1030), Texas Penal Code Chapter 33 (Computer Crimes), and similar laws in other countries. We may block access, preserve evidence, and refer unauthorized activity to law enforcement. Nothing in this policy grants permission or safe harbor for testing.
Our systems automatically detect common scanning, attack and code-guessing activity and block the source IP address: for 1 hour at first, and up to 7 days if it continues. A block, or the absence of one, does not mean any activity is permitted.
1A. Keeping your account safe
- On a shared or public computer (for example at an event booth), tick "This is a shared or public computer" when you sign in. You'll be signed out when the browser closes, and after 12 hours at most.
- Lost a device, or forgot to sign out somewhere? Open Settings → Account and choose Sign out of all devices.
- Downloading your data or closing your account always needs a fresh code sent to your email. We'll never ask you for that code by phone, chat or any other email. If you get a verification code you didn't ask for, don't share it, and sign out of all devices.
2. Found something by accident? Tell us
If you notice a vulnerability or bug while using Coffee Breach normally, we want to hear about it. Please:
- Stop as soon as you notice it. Do not try to confirm it further, escalate it or use it.
- Do not access, copy, change or delete any data that is not yours. If you saw any by accident, do not keep or share it, and delete any copies.
- Do not disclose the issue publicly or to anyone else until we have fixed it and agreed to disclosure.
- Report it promptly to security@coffeebreach.com.
3. What to include in a report
- a short description of the issue and its potential impact;
- where you noticed it (page, feature or URL) and when;
- the steps that led you to it during normal use, and screenshots if helpful;
- how we can contact you (optional, but it helps us follow up).
Please do not include other people's personal information in your report.
4. What you can expect from us
- We aim to acknowledge reports within 3 business days.
- We will look into every report, keep you updated on significant progress where we can, and let you know when the issue is resolved.
- We prioritize fixes by severity and impact on players.
- With your permission, we are happy to thank you publicly for a valid report made in line with this policy. We do not offer monetary rewards.
5. Bugs that aren't security issues
Found a gameplay bug, a wrong answer in a question, or something broken? Email security@coffeebreach.com with the subject "Bug report", and include the question's file name shown above the code if it's about a question. For an "In the News" question, include the advisory ID it shows (for example a CVE or GHSA number). If your network was blocked by mistake (for example a shared office or event network), use the subject "Blocked" and include the time, your IP address and what you were doing. To report an offensive username, profile photo or event name, use the subject "Report content" and include the username.
6. Machine-readable contact
Our security contact is also published in /.well-known/security.txt (RFC 9116).
7. Changes
We may update this policy at any time by posting a new version on this page.