Security policy
Found a security problem in Bluesky.bot? Thank you for telling us. Please report it privately, so we can protect bot creators before anything is made public.
Report a vulnerability
Email [email protected], in English or French.
Do not open a public issue, post or discussion about a security problem.
Please include:
- a description of the issue and its impact;
- steps to reproduce or a proof of concept;
- affected URLs, routes or files;
- any suggested fix.
Do not include real user data or live credentials in the report.
What to expect
- Acknowledgement within 72 hours.
- A first assessment within 7 days.
- A fix, then public disclosure coordinated with you once users are protected. Credit is given if you wish.
Scope
- The web app at bluesky.bot and *.bluesky.bot handle resolution (/.well-known/atproto-did)
- Bluesky OAuth sign-in and session handling
- The public API, admin back-office and labeler service
Out of scope: denial of service through volume, social engineering, and issues in third-party services (Bluesky, Cloudflare) that should be reported to them.
Supported versions
Only the current production deployment at bluesky.bot receives security fixes.
Machine-readable contact
The same contact is published in /.well-known/security.txt (RFC 9116).