Security

Beta Beta. Last updated 26 October 2026

If you find a security problem in Eracade, please tell us. We welcome good-faith research and will work with you.

How to report

Email security@eracade.com. Please include what you found, steps to reproduce, the affected URL, and the impact as you see it. Proofs of concept are welcome. Do not include real personal data. Our security.txt has the same contact details.

What to expect

• We acknowledge reports within 3 business days.
• We will keep you updated, tell you when it is fixed and, if you wish, credit you publicly. We ask that you give us reasonable time to fix an issue before sharing details.
• We do not offer a paid bug bounty at this time.

Scope

In scope: eracade.com, including its pages and games. Out of scope: other Unflatline or Atarus Security sites, Cloudflare's own systems and services, and anything else we do not own.

Please do not

• access, change or keep data that is not yours, or harm players or the service;
• run denial-of-service, spam or volumetric tests;
• use social engineering, phishing or physical attacks against anyone;
• publicly disclose a vulnerability before we have had a reasonable chance to fix it.

Purely theoretical issues, missing best-practice headers with no demonstrated impact, and the fact that a player can edit their own locally stored scores are generally not treated as vulnerabilities.

Safe harbour

If you make a good-faith effort to follow this policy, we will consider your research authorised, we will not pursue or support legal action against you for it, and we will not treat it as a breach of our Terms of Use. If a third party starts legal action against you for research that followed this policy, we will make it known that your actions were authorised. This policy cannot authorise acts against systems we do not own, and it does not bind others.