Security & Responsible Disclosure

01Our commitment

The security of our players and partners matters to us. If you find a vulnerability in our websites, games or infrastructure, please tell us so we can fix it quickly.

02Scope

• sencorpgames.com and subdomains owned by Sencorp Games.
• Published game clients and the backend services we operate.
• Beta or staging environments we explicitly provide for testing.
• Our apps distributed through official app stores.

03Out of scope

• Denial-of-service, DDoS or other volumetric attacks.
• Brute force, credential stuffing or spam campaigns.
• Social engineering of employees, contractors or players.
• Physical attacks against our premises or property.
• Vulnerabilities in third-party services or platforms outside our control.
• Low-risk findings, such as missing headers, without demonstrable impact.
• Issues that need highly unlikely user interaction or physical device access.

04How to report

Email contact@sencorpgames.com with the subject “Security report” and include:

• A clear description of the vulnerability and its potential impact.
• Steps to reproduce, with proof-of-concept code, screenshots or a short video.
• The affected asset: URL, app name, version and platform.
• Your contact details for follow-up and acknowledgement.
• Tools or techniques used (optional but helpful).

05Responsible disclosure guidelines

Please do

• Act in good faith and avoid privacy violations, data loss or service disruption.
• Minimise impact, using test accounts where possible.
• Keep findings confidential until they are fixed.
• Stop immediately if you access personal, financial or sensitive data.
• Give us reasonable time to fix the issue before any disclosure.
• Contact us again if you hear nothing within 72 hours.

Please don’t

• Exfiltrate, alter or destroy data you should not have access to.
• Keep persistent access to systems, such as backdoors or shells.
• Exploit a vulnerability beyond what is needed to demonstrate it.
• Disclose publicly before we have had a chance to fix it.
• Demand payment or a bounty (unless we announce a bug bounty programme).
• Break any law or regulation during your research.

06Safe harbour

If you follow this policy and act in good faith, we will not start or support legal action against you for your research. Safe harbour covers activity that follows this policy, breaks no law and is genuinely aimed at improving security. It does not cover unlawful or malicious actions or anything beyond this policy.

07Triage and response times

• Acknowledgement within 72 hours (3 business days).
• Initial triage and severity assessment within 5 business days.
• Progress updates at reasonable intervals.
• Fixes prioritised by severity, exploitability and impact.

08Credit and acknowledgement

With your permission, we may credit you publicly once the issue is fixed, mention your research in release notes where appropriate, or provide a reference on request.

There is no guaranteed monetary reward unless we announce a separate bug bounty programme. Acknowledgement is given in good faith.

09Coordinated disclosure

We believe in coordinated disclosure. Please agree a disclosure timeline with us and avoid publishing exploit code or detailed write-ups until a fix is deployed. We aim to fix critical vulnerabilities within 30–90 days and will keep you informed.

10Changes to this policy

We may update this policy as our products and security practices evolve. The latest version is always published on this page.

11Contact

Security reports and questions: contact@sencorpgames.com. For anything else, use our contact page. Thank you for helping keep Sencorp Games safe.