# Security Policy

## Reporting a Vulnerability

If you find a security issue in HellionChat, please do not open a public Gitea issue. Use one of the
private channels below so I can investigate and ship a fix before the details go public.

**Preferred:**

| Channel    | Address                    |
| ---------- | -------------------------- |
| Email      | `kontakt@hellion-media.de` |
| Discord DM | `@j.j_kazama`              |

For urgent disclosures (active exploitation, user-data exposure) email is the fastest path.

I respond on weekdays during European business hours.

## Scope

### In scope

- Code paths that touch user-controlled input (chat messages, plugin config, file paths the user can
  influence)
- The privacy filter in `MessageStore.cs` and the export pipeline
- The configuration migration logic
- The `EmoteCache` HTTP client and path handling
- The Auto-Tell-Tabs spawn logic and history preload

### Out of scope

- Issues in upstream Chat 2 that HellionChat has not modified — report those at
  <https://github.com/Infiziert90/ChatTwo/issues>
- Issues in Dalamud itself — those go to <https://github.com/goatcorp/Dalamud>
- Issues in the FFXIV game client
- Anything that requires the user to install a malicious plugin first

## Disclosure Window

I aim to ship a fix within 14 days for high-severity issues and within 30 days for everything else.
If a fix needs more time I will say so in the private thread.

## Credits

Everyone who reports a real issue gets listed in the changelog of the release that fixes it, unless
they prefer to stay anonymous. No bug bounty, nothing financial — this is a hobby plugin.
