Security Notice

Last modified: October 28, 2026

This notice explains how to report a security vulnerability in the Vanilla Tyme website. If you have found one, we want to hear about it so we can fix it before anyone misuses it.

Reporting a vulnerability

Open a ticket in our Discord. Tickets are only visible to staff. Do not post vulnerabilities in public channels or share them with other players. Please include:

• the page or feature where the vulnerability can be found;
• a short description of the vulnerability and what it could let someone do;
• steps to reproduce it that don't harm other players or their data.

We will reply as soon as we can and let you know when it is fixed.

Testing responsibly

• Only test with your own account. Don't access, change or delete other players' data.
• Stop as soon as you have confirmed the issue, and don't keep any data you came across.
• Give us a reasonable amount of time to fix the issue before telling anyone else.

If you follow these guidelines and report in good faith, we won't treat your research as a break of our Terms of Use or Content Rules.

Out of scope

• attacks that overwhelm the website with traffic, such as denial of service;
• reports that only say something doesn't follow "best practice", such as missing headers;
• services we don't run, such as Tebex, Discord or Minecraft. Report those to the company that runs them.

If you're not sure whether something counts, open a ticket and ask.