Security
Reporting a security problem
If you have found a way to see, change or break something in DinkPartner that you should not be able to, we want to hear about it, and we will not treat you as an attacker for telling us.
Last updated .
1.Report a vulnerability
Email [email protected] with “Security report” in the subject. Tell us what you found, the steps to see it again, and what someone could do with it. Screenshots or a short recording help. Please do not include other people’s personal data beyond what is needed to show the problem.
The same address is listed in our security.txt file.
2.What we promise
- A reply — within 3 business days, from a person.
- A plan — within 10 business days: whether we can reproduce it, how serious we think it is, and when we expect to fix it. Critical problems are fixed within 7 days, high within 30.
- Updates — until it is fixed, and a note when it is.
- Credit — if you would like it, once the fix has shipped.
- No legal action — against anyone who follows the rules in section 4. We do not run a paid bug bounty.
3.What is in scope
- In scope — the DinkPartner app for iPhone and Android, this website, the API it talks to, and our admin tools.
- Out of scope — denial-of-service and load testing, spam or social engineering of our players or staff, physical attacks, and problems in services we use (report those to the provider — we are happy to help).
4.Testing in good faith
- Use your own accounts — create test accounts; never get into, change or delete someone else’s data. If you reach real personal data by accident, stop, tell us, and do not keep it.
- Keep it quiet — give us a reasonable chance to fix the problem before you tell anyone else — normally 90 days, or sooner once it is fixed.
- Do no harm — no automated scanning heavy enough to slow the service, and nothing that affects games, ratings or payments of real players.
VertexSpot LLC, 920 US Hwy 64 W, Apex, NC 27523.