Please report security problems in private: use the Report a vulnerability button on the Security tab of this repository, or write to contato@aioncore.app. Do not open a public issue, pull request or Discord post about a vulnerability.

Useful details: the AionCore version (Settings > About), what you found, the steps to reproduce it and what you think the impact is. Please do not include character names or other personal data.

We will reply as soon as we can, work on a fix and tell you when it ships. This is a small independent project, so we cannot promise a fixed response time.

In scope:

• The AionCore installer and the installer files published in this repository's releases.
• The AionCore desktop app, including its updater and its sign-in with Discord.
• The AionCore website and its API at aioncore.app.

Out of scope:

• Aion 2 itself, the game servers and anything owned by NCSOFT.
• Problems that need an attacker who already controls your PC or your Windows account.
• Social engineering, spam, and automated scanner reports with no proof of impact.
• Denial of service by sending large amounts of traffic.

• Access, change or delete data that is not yours.
• Disclose the problem publicly before it is fixed.

Only the latest published version is supported. AionCore updates itself, so please update before reporting.