Vulnerability disclosure policy
Found a security issue in our games or website? Tell us, and we will work with you to fix it.
At a glance
- Report to
- security@infinityweb.io
- First reply
- Within 3 business days
- Fix target
- Critical issues within 30 days
- Safe harbour
- Yes, for good-faith research within this policy
- Rewards
- Public thanks. No paid bug bounty yet
01Our approach
Keeping player accounts and matches safe matters to us. If you find a weakness in our games or services, we want to hear about it. This policy explains what is in scope, how to report, and what you can expect from us.
02In scope
- Website
- games.infinityweb.io and its subdomains.
- Games
- IW Backgammon on web, iOS and Android, current released versions.
- APIs
- Game, matchmaking, account and leaderboard APIs used by our apps.
03Out of scope
- Third parties
- Apple, Google, hosting providers and other services we use. Report those to the vendor.
- Low impact
- Missing headers without a working exploit, clickjacking on pages with no sensitive actions, self-XSS.
- Social engineering
- Phishing, pretexting or physical attacks on our staff or offices.
- Denial of service
- Volumetric attacks, load testing or anything that degrades service for players.
- Gameplay bugs
- Rules or display bugs with no security impact. Send those to games@infinityweb.io.
04Rules of engagement
When testing, please:
- Use your own accounts
- Only access data that belongs to you or to test accounts you create.
- Stop when you find data
- If you reach other players’ data, stop, do not keep or share it, and tell us right away.
- Protect fair play
- Do not affect ranked matches, ratings or leaderboards of real players.
- Keep it confidential
- Give us reasonable time to fix the issue before telling anyone else.
05How to report
Email security@infinityweb.io with a description of the issue, the steps to reproduce it, the affected URL, app version or endpoint, and the impact you think it has. Screenshots or a short video help. You can ask for our PGP key if you want to encrypt your report.
We also publish our contact details in a security.txt file at games.infinityweb.io/.well-known/security.txt.
06What to expect
- Acknowledgement
- Within 3 business days.
- Assessment
- An initial severity rating and next steps within 10 business days.
- Fix
- Critical issues within 30 days, others as soon as we reasonably can. We keep you updated.
- Credit
- With your permission, we thank you by name on this page once the issue is fixed.
07Safe harbour
If you act in good faith and follow this policy, we will not take legal action against you or ask law enforcement to investigate, and we consider your research authorised. If a third party takes action against you over research that followed this policy, we will make it known that you acted with our permission.
08Public disclosure
We prefer coordinated disclosure. Once a fix is released, we are happy for you to publish your findings, and we ask that you share a draft with us first. If we cannot fix an issue within 90 days, we will agree a disclosure date with you.