# Security

If you find a security problem in Carnival, please tell us. Email <security@carnival.dev>; we acknowledge every report
within 3 business days. Our [security.txt](https://carnival-staging.dev/.well-known/security.txt) lists the same contact.

## What to include

- What you found, and what someone could do with it.
- Where: the page, tool or endpoint, and the steps to reproduce it.
- The email address of the account you tested with, so we can find your test sites.
- How to reach you.

## Rules for testing

- Test only with your own account and your own sites. Don't access, change or delete anyone else's data; if you come
  across it, stop, don't keep it, and tell us.
- No denial of service, load testing or spam.
- No social engineering of our team or our users, and no physical attacks.
- The [content policy](https://carnival-staging.dev/content-policy.md) applies to your test sites too.
- Give us a chance to fix the problem before you tell anyone else.

## What we do

We acknowledge your report within 3 business days, tell you what we find, and let you know when it's fixed.

To report a Carnival site that phishes, spreads malware or breaks the content policy in some other way, use the
[report form](https://carnival-staging.dev/report) instead.