Abuse &
Security Reporting
Anyone can report misuse of a CodeOn service — whether they are a customer, a player on someone's server, or a third party whose systems or people are being harmed. This page explains how to reach us and what to expect.
1. Where to report
Use email for anything you want on record, Discord for anything bleeding in real time, and client-area tickets for matters tied to your own account.
There are no separate abuse@ or security@ mailboxes: reports through support@codeon.lk and the Discord community above reach the same team that handles them.
2. What to include
- What happened, in a few sentences, without assuming we can see context we don't have.
- When — dates and times, with your timezone.
- Where — the server address, domain, port or IP involved. For attacks, the source identifiers you can see.
- Evidence — logs, screenshots, chat records. Plain text or standard formats are best.
- Your contact — how we can reach you for follow-up, if you want a reply.
For child-safety concerns: report to the relevant law-enforcement channel in your country as well as to us — some things should never wait for a hosting provider's queue.
3. How reports are handled
- Reports are triaged by severity: attacks, malware, child safety and fraud come before commonly filed matters like server disputes.
- Action taken against a reported service follows section 4 of the Acceptable Use Policy.
- We make no response-time promise at this stage. No guaranteed acknowledgment or resolution timings are published anywhere on this site, because none has been formally committed. If something is an emergency, the Discord route beats the email queue — this is a practical suggestion, not an SLA.
- Anonymous reports are accepted; a contact address just lets us come back to you with follow-up questions or the outcome.
4. Security issues in our own systems
If you have found a vulnerability in CodeOn's website, client area, control panel or network:
- Email support@codeon.lk with technical details, proof of concept and reproduction steps. Where possible, mark it clearly as a security report in the subject.
- Do not exploit it for effect — no data destruction, no access beyond what is needed to demonstrate the issue, no public disclosure before we have fixed it and agreed disclosure timing with you.
- Research done in good faith — non-disruptive, promptly reported through the routes above, honouring coordinated disclosure — will not be met with legal action from us over the act of research itself. We do not run a paid bug-bounty programme; credited thanks in the community is what we offer, not payment.
A formal vulnerability-disclosure policy does not exist yet. This section is the working basis for one and must be internally finalised before this page is published as final.
5. Law-enforcement contact
Valid legal processes are honoured where we are legally compelled; route correspondence through the email contact above. We act only as far as the request actually requires. Law-enforcement correspondence goes to support@codeon.lk (subject line: "Legal request"); we act under the laws of Sri Lanka and only as far as a valid request requires.
6. If you were wrongly reported
Servers get reported in error sometimes — an angry player is not the same as abuse. If a report was made about your service and you believe it was mistaken, reply to our communication with your evidence through a client-area ticket, or appeal as described in the Acceptable Use Policy.