Draft. This page may change before it is final. Version 2026-10-draft1.
Security
If you find a security problem in Carnival, please tell us. Email security@carnival.dev; we acknowledge every report within 3 business days. Our security.txt lists the same contact.
What to include
- What you found, and what someone could do with it.
- Where: the page, tool or endpoint, and the steps to reproduce it.
- The email address of the account you tested with, so we can find your test sites.
- How to reach you.
Rules for testing
- Test only with your own account and your own sites. Don't access, change or delete anyone else's data; if you come across it, stop, don't keep it, and tell us.
- No denial of service, load testing or spam.
- No social engineering of our team or our users, and no physical attacks.
- The content policy applies to your test sites too.
- Give us a chance to fix the problem before you tell anyone else.
What we do
We acknowledge your report within 3 business days, tell you what we find, and let you know when it's fixed.
To report a Carnival site that phishes, spreads malware or breaks the content policy in some other way, use the report form instead.