DebateOwl handles student accounts, debate work, and payments, so security reports are welcome and taken seriously.
Please report vulnerabilities privately. Do not open a public issue, pull request, or discussion.
- Preferred: use GitHub's private vulnerability reporting for this repository.
- Or email hello@debateowl.com with "Security" in the subject.
Include what you found, where (URL, endpoint, or file and line), the steps to reproduce it, and what an attacker could do with it. A short proof of concept helps.
You can expect a first reply within 5 working days. Once a fix ships, we're happy to credit you in the release notes if you'd like.
In scope:
- The hosted app at debateowl.com and its Supabase backend (Auth, database policies, Edge Functions).
- The source code in this repository.
Out of scope:
- Denial-of-service and load testing, spam, and social engineering.
- Findings that need a compromised device or browser.
- Reports from automated scanners without a demonstrated impact.
- Third-party services DebateOwl uses (Supabase, Vercel, Stripe, OpenRouter and others). Report those to the vendor.
- Use only accounts you created yourself. Never access, change, or delete another user's data; if you reach some by accident, stop and tell us.
- Keep AI usage small, and don't make real payments, refunds, or chargebacks as part of testing.
- Give us a reasonable time to fix an issue before you disclose it publicly.
Testing that follows these rules in good faith will not be treated as abuse.