Security Policy

The Security Policy explains how to report a security vulnerability in DragonMineZ and how the team handles it. The DragonMineZ team values the community's effort in disclosing vulnerabilities responsibly, takes security issues seriously and is committed to resolving them promptly to protect its users.

Reporting a vulnerability

Do not disclose it publicly. Sharing the details of a vulnerability before it is resolved could put users at risk.
Submit a report through the Report a Vulnerability tab on GitHub. Alternatively, you can contact the team on Discord.
Include these details in your report:
- steps to reproduce the issue;
- affected versions;
- potential impact;
- any suggested fixes or mitigations, if available.

What to expect

The team acknowledges your report within 48 to 72 hours.
The team investigates and gives you a plan of action within 10 days or less.
You are kept updated throughout the process and credited for your discovery, unless you wish to remain anonymous.

Fixes and notifications

After verifying and fixing a security vulnerability, the team will:

release a patch for the affected versions listed in the supported versions table;
publish a security advisory that summarizes the issue, its impact and how it was resolved;
notify the relevant parties as necessary.

Supported versions

These versions are actively supported with security updates:

Version	Supported
2.x (latest)	Yes
Older versions	No

Securing your server

A few settings matter for keeping a DragonMineZ server safe:

Database credentials: if you use the DATABASE storage backend, replace the default username and password (root / password) in the storage section of general-server.json, and give DragonMineZ its own database user with access to its own database only. See General Server Config.
Permissions: DragonMineZ commands are protected by permission nodes. Only give admin-level nodes (stat editing, config reloads, quest management and so on) to trusted staff. See Permissions.
Backups: back up the world folder (and your database, if you use one) before switching storage backends or updating the mod. See Notice to Server Owners.
Official downloads only: install DragonMineZ only from its official Modrinth and CurseForge pages.

For add-on developers

Never trust values sent by the client in your own packets. Validate on the server anything that changes stats, unlocks, quests, wishes or progression (see Implementation and Events).

Thank you for helping keep DragonMineZ secure.