Security and Responsible Vulnerability Disclosure

1. Security measures

• TLS 1.2+ encryption in transit between clients and servers.
• Password hashing using the bcrypt algorithm; constant-time login flow as protection against timing-based enumeration.
• Rate limiting of logins and sensitive API endpoints.
• Separate environments for production and development.
• Regular database backups with a retention period of at least 30 days.
• Logging and audit trails for sensitive operations (logins, payouts to Tipsters via Stripe Connect, FK spending, password changes).
• Least privilege principle for internal access.

2. Responsible Disclosure

The Operator welcomes responsible reporting of security vulnerabilities. Against researchers who proceed in accordance with this policy, the Operator will not file a criminal complaint for conduct within the bounds of this policy (§ 230 and § 231 of the Criminal Code) nor pursue civil claims; it cannot, however, rule out action by law-enforcement authorities acting ex officio. Where this policy is observed, the Operator will provide cooperation to the researcher and confirm that the testing was authorised.

3. Rules for researchers

• Do not access other users' data, other than your own test account.
• Do not perform DoS/DDoS, do not carry out social engineering against staff, do not interfere with physical infrastructure.
• Do not disclose a vulnerability before the agreed date (embargo typically 90 days from the report or as agreed).
• Reports must contain a sufficient description, reproduction steps and impact.

4. Safe Harbor

A researcher acting in good faith and in accordance with the rules above is guaranteed that their conduct will be assessed as an authorised security test. The Operator waives the right to apply sanctions against such a researcher, provided no harm was caused to user data.

5. Incident notification to users

In the event of a personal data breach posing a risk to users, the Operator will notify the incident to the Office for Personal Data Protection (ÚOOÚ) within 72 hours (Art. 33 GDPR) and the affected data subjects without undue delay (Art. 34 GDPR), where required by law.

6. Operator contact

Maxim Ponomarenko, náměstí Naděje 771, 566 01 Vysoké Mýto. General enquiries: [email protected].