Report a Vulnerability

Responsible disclosure policy · last updated 7 October 2026

We build an anticheat and an anti-ESP plugin. If you have found a way around one of them, or a security flaw in our plugins, our bot or this website, we want to hear about it from you rather than from a server owner whose world just got stripped.

Please do not post bypasses, exploits or proof-of-concept code in public Discord channels, on forums, or in a public bug report. Report it privately using the steps below.

How to report

Open a private support ticket. It creates a channel that only you and our team can see.

Open a private report

If you cannot use the ticket system, send a direct message to a staff member in our Discord server and ask for a private channel. Do not describe the issue in a public channel first.

What to include

• Which plugin and version, and the server version you tested on.
• What the issue is, in plain terms.
• Exact steps to reproduce it. A short clip or log helps a lot.
• What an attacker gets out of it.
• If it is a bypass: the client or module used, and roughly how it defeats the check.

What we promise

• We will acknowledge your report as quickly as we reasonably can.
• We will tell you whether we consider it an issue, and why.
• We will keep you updated while we work on a fix.
• We will credit you in the changelog when the fix ships, if you want to be credited.
• We will not take legal action against you for a report made in good faith under this policy.

What we ask

• Give us a reasonable chance to fix it before telling anyone else.
• Only test against your own server, never someone else's.
• Do not destroy data, grief, steal from players, or disrupt a live server to prove a point.
• Do not sell the bypass or hand it to a cheat client while we are fixing it.

In scope

• Anticheat bypasses in FlakeAC.
• Ways to see hidden blocks, containers, entities or the world seed through FlakeAntiESP.
• Flaws in our plugins that let a player gain permissions, crash a server, or read data they should not.
• Vulnerabilities in this website, its API, or our Discord bot.

Out of scope

• Issues in Minecraft, Paper, PacketEvents, Discord or Vercel themselves. Report those to their maintainers.
• Missing hardening that has no practical attack behind it.
• Problems that need an already-compromised server or operator access.
• Social engineering of our staff or our community.

Rewards

We do not run a paid bug bounty. For a solid report we offer credit in the changelog and, at our discretion, a free licence or an extension of one. We will be straight with you about what we can offer before you spend more time on it.

The machine readable version of this policy is at /.well-known/security.txt.