wiki

Reporting a security problem

somtum.fun is kept up to date by experienced developers, and our team does its best to protect the server and fix any security problem, such as an anti-cheat bypass, remote code execution (RCE) or a known vulnerability (CVE). We also review our code at random.

Sometimes we still miss things. That's why we made TomYum, the server somtum.fun runs on, open source: more people can look at it and tell us what we got wrong.

How to report

Email [email protected] directly, with as many details as you can. Please don't post it in public or on Discord until it's fixed, so nobody can use it against other players.

Tell us:

  1. What the problem is, and what someone could do with it.
  2. How to make it happen, step by step. Code or a short video helps.
  3. Where it is: the website, the game server, a client, the anti-cheat, and which version.
  4. How to reach you, if you'd like us to follow up with somewhere other than your email.

What you can expect from us

We try our best not to bullshit anyone, whether you found the problem or were affected by it. If something went wrong, we'll say what happened and what we did about it.

Have a bug that isn't about security? See Reporting a bug.