Mothlight is passive, defensive research. If you find a vulnerability in this site or its API, please tell us so we can fix it — we will not take action against good-faith research that follows this policy.
Email help@mothlight.ai with the affected URL or endpoint, steps to reproduce, and the impact you observed. Do not include real passwords, API keys, or other people's data. Our machine-readable contact is security.txt, whose Policy field points to this page.
This brand site, its public API under /api/v1, and the access-request and contact forms. Decoy and honeypot surfaces are intentionally deceptive research systems: unexpected behaviour there is usually the experiment, but reports of data exposure beyond the published policy are welcome.
Do not scan, probe or attempt to contact observed attacker infrastructure, sensor IPs, or decoy hosts beyond ordinary browsing. Do not attempt denial of service, social engineering, or access to other users' API keys or request data. Never send traffic to observed source IPs.
We aim to acknowledge a report within two working days, confirm or close it after investigation, and credit reporters who ask to be named once a fix ships. Please give us reasonable time to fix an issue before disclosing it publicly.
To request a correction or removal of published observation data (for example your IP or bot ID), email the address above with the UTC observation window and reason. See the ethics page for the publication and retention policy.