Security reporting contact
Use the subject “Security report — REEVEES” and identify the affected website or product version.
What to include
Describe the observed behavior, the affected component, the expected behavior and minimal reproduction steps using your own test data. A redacted screenshot or a short technical extract is usually enough to start.
What not to send
Do not send passwords, API secrets, private signing keys, full license keys, customer records, complete Unity projects or third-party asset packs. Contact us before transmitting a sensitive proof of concept or any archive.
Keep testing safe
Do not access other people's data, interrupt services, attempt social engineering or test third-party systems. This reporting page does not grant permission for intrusive testing, data extraction or denial-of-service testing. Stop if unexpected sensitive information becomes visible.
Private coordination
Keep sensitive details out of public reports while the issue is being reviewed. No response-time guarantee, bounty payment or blanket legal authorization is offered on this page. Standard email is the initial contact route; no end-to-end encrypted submission channel is advertised here.
Current website scope
The public REEVEES website requires no customer account and processes no payments or license activations. A protected administration area exists on secure.reevees.com. Support requests and time-limited, one-time file uploads run through that secure server area; uploaded files are kept in quarantine and scanned for malware before support opens them. Nexus copy protection and signature checks run entirely locally in the customer's Unity project: there is no online license check and no remote unlock, and no private signing keys are stored on the server.
Machine-readable contact
The contact information is also provided in security.txt. It does not create an upload endpoint or authenticate product state.