Do not open a public issue or pull request for a security vulnerability. Use either confidential contact:

• Email: security@soulfiremc.com.
• Discord: send a private message to pistonmaster through the SoulFire community.

Include enough information for maintainers to reproduce and assess the problem:

• The affected SoulFire version and component, including SDK versions if relevant.
• Your operating system, Java or SDK runtime version, and deployment method.
• Reproduction steps or a minimal proof of concept.
• The expected result, actual result, and potential impact.
• Any required permissions, configuration, or network access.
• Relevant logs with tokens, passwords, account data, and proxy credentials removed.

Use an isolated environment and systems that you own or have permission to test. Do not include real credentials or private user data in a proof of concept.

Include the exact affected version, even if it is an older release or development build. For normal deployments, use the latest release. The project does not publish a fixed support period or backport schedule for older releases.

Keep exploit details private while maintainers investigate. Coordinate publication with maintainers so users can receive a fix or mitigation first. Response and release timing depend on the report. This policy does not promise a response deadline.

For ordinary bugs, feature requests, and usage questions, use the support resources.