ASVLA Vulnerability Disclosure Policy

We welcome reports of security vulnerabilities in ASVLA systems.

Contact: it-sec@asvla.com
Language: English


REWARDS

ASVLA does not have a paid bug bounty program. We do not pay for
reports. We do not agree to payment as a condition of disclosure,
and we do not reply to requests for payment.


HOW TO REPORT

Send the full report to it-sec@asvla.com in your first message.
Include:

- The affected URL, app or system.
- The steps to reproduce the issue.
- The impact, with proof.


SCOPE

In scope: systems that ASVLA owns and operates, including asvla.com
and its subdomains.

Out of scope:

- Services that third parties operate, for example game providers
  and payment providers. Report these to the third party.
- Findings from automated scanners with no proof of impact, for
  example missing security headers, SPF, DKIM or DMARC settings,
  clickjacking on pages with no sensitive action, software version
  disclosure, and missing rate limits with no impact.
- Social engineering, phishing and physical attacks.
- Denial of service.


RULES

- Use only accounts that you own. Do not use the identity or the
  documents of another person.
- Do not access, change, keep or delete data that is not yours. If
  you see player data, stop and report it immediately.
- Do not make real-money deposits, bets or withdrawals to test a
  vulnerability.
- Do not do tests that decrease the availability of our services.
- Do not disclose the vulnerability before we confirm that it is
  fixed.


WHAT WE DO

- We confirm that we received your report.
- We tell you when the issue is fixed.