Found something? Tell us.

Email legal@metrobot.app with what you found, the steps to reproduce it, and what you think the impact is. Include a Discord server or guild ID only if it's directly relevant — don't paste player data into the report.

A machine-readable copy of this contact lives at /.well-known/security.txt, per RFC 9116.

Please don't test against a server you don't own or have permission to test against.

In scope: this dashboard, the Metro Discord bot, and the poller service behind them.

Out of scope: Discord, Roblox, and the ER:LC private-server API themselves — those go to their own teams. If your report turns out to be about the ER:LC API rather than Metro, we'll pass it to PRC's own contact at flatbird@erlc.gg, since that's their documented first point of contact for API issues.

We'll acknowledge a real report and keep you posted as we work on it. We don't currently run a paid bug bounty. If a fix requires rotating anything (an encryption key, a webhook secret), we do that as part of the response, not after.

Reporting a genuine issue in good faith, without accessing data beyond what's needed to prove it, won't get you in trouble with us. Our full terms are at /legal/terms.

Every ER:LC Server-Key is encrypted at rest with a per-guild data key, sealed to a key pair whose private half only the poller process holds. The dashboard seals a key with the public half and can't decrypt one, not even the key it just stored. Keys are never logged and never displayed again once entered. See the privacy policy for what player data we keep and for how long.