Thank you for helping keep LastSave and the people who use it safe.

Please don't open a public issue, discussion or Discord post for a security problem. Report it privately instead, in either of these ways:

• Email security@lastsave.app
• GitHub — report a vulnerability on the lastsave repository

Include what you found, how to reproduce it, and what someone could do with it. A proof of concept helps, but isn't required.

LastSave is built by one developer, so here's an honest timeline:

• Within 7 days: a reply confirming the report was received.
• After that: updates as it's investigated and fixed, and a heads-up before anything is published.
• Once fixed: credit in the release notes, if you'd like it.

There is no paid bug bounty at this time.

• The LastSave desktop app for Windows, in its latest release
• lastsave.app, api.lastsave.app and igdb.lastsave.app

Only the latest release receives security fixes. LastSave updates itself, so a fix reaches everyone through the regular update.

• Access, change or delete data that isn't yours
• Run denial-of-service or high-volume automated tests against the services above
• Use social engineering against the community or the project's accounts