Report a security vulnerability
You found a security issue on AlsNime? Thank you: here is how to tell us safely.
How to contact us
Write to security@alsnime.com (French or English). Please do not use the contact form or public areas of the site (reviews, discussions) for a vulnerability.
If possible, include:
- the affected address (URL) or feature;
- the steps to reproduce it, and what it allows (the impact);
- when you tested and which test account you used;
- how to reach you, and whether you would like public credit.
Our commitments
- Acknowledgement within 7 days, then updates at each step.
- A fix as fast as possible, accounts and data exposure first.
- No legal action for research done in good faith within the rules below.
- AlsNime is a non-commercial website: no bounty, but public thanks if you wish.
Rules
- Use your own accounts; do not access other members’ data beyond what is strictly needed to prove the issue, and delete it afterwards.
- No denial of service, mass sending, phishing or social engineering against members or the team.
- Do not modify or delete data that is not yours.
- Give us reasonable time (up to 90 days) before any publication.
Out of scope
- Automated scanner reports without a demonstrated real impact.
- Missing best practices with no possible exploitation (headers, version banners…).
- Issues requiring physical access to the victim’s device, or self-XSS.
- Third-party services (Cloudflare, Resend, AniList): report them to their vendors directly.