Where do I send it
Mail to nmts@nmts.me reaches the operator directly. The question form needs neither an account nor an email address of yours, and hands you a reference number and a reading code so you can come back and read the answer.
⚠ Messages in the form are deleted after 30 days. If the exchange is likely to be long, use mail. We cannot reissue the reference number or the reading code, so keep them.
What should I write
Write what you did, what happened, and how we can see the same thing ourselves.
The form takes text only. If your report needs a file or a screenshot, say so, and the reply tells you where to put it.
What is in scope
nmts.me and the endpoints under it, and the NMTS page code that runs in your browser.
Sui and Walrus are neither built nor operated by us. We cannot fix defects there, so report those to the projects themselves. If the problem is in how we use them, that is ours.
May I test it myself
Ask first. Write to nmts@nmts.me before you begin, saying who you are and what you mean to test. We answer within 14 days, and silence is not a yes — if no answer has come by then, treat it as no. If we answer yes, then for the work that answer describes we bring no claim against you and do not report you for it. What you write reaches the support mailbox, which is held for 30 days and, within those days, is reachable by a binding order (Terms 12.9).
There are things that answer never covers, and one limit that sits over all of it. It is not authorisation for anyone who has not asked — whether access was authorised is judged at the moment it happens, so testing first and writing afterwards leaves you outside it. Destructive work is outside every permission we give: damaging the service or the data in it, degrading it for other people, or reading, copying or keeping another person's data — if a flaw exposes somebody else's data, stop where you have shown it can happen. And the limit over all of it: we can give only what is ours to give, so we cannot waive another person's claim or bind a public authority.
What the server can see
File contents are encrypted in the browser, so the operator cannot open them. What the server sees is file counts, sizes and times.
The source for the cryptography is public.
What happens next
Once we have confirmed it, we answer in the same thread.
There is no reward programme.