How to report
Email arghyaghosh574@gmail.com with a clear subject such as AuctionVerse Security Report. Include the affected URL or feature, reproduction steps, impact, and screenshots or request examples where useful. Do not include unnecessary personal data belonging to other users.
Good-faith testing
- Use accounts and leagues you control whenever possible.
- Stop testing if you encounter private data that is not yours.
- Do not modify or delete another user's data.
- Do not disrupt live auctions, drafts, fixtures, scoring or authentication.
- Do not perform denial-of-service, spam, social engineering, phishing or physical attacks.
- Do not publicly disclose an unresolved vulnerability before we have had a reasonable opportunity to investigate and fix it.
What is helpful
High-value reports include authorization bypasses, account takeover paths, exposed private credentials, cross-user data access, unsafe server-side operations, and vulnerabilities that could alter auctions, drafts, squads or scoring without permission.
Out of scope
Automated scanner output without a reproducible security impact, findings that do not produce a practical security impact, rate-limit observations that do not enable abuse, and issues caused only by unsupported third-party browser extensions may be treated as informational.
Our response
We will try to acknowledge useful reports, assess severity, reproduce the issue and deploy a safe correction. Response timing can vary based on complexity and available resources.
Important boundary
This policy is intended to guide good-faith reporting. It does not authorize unlawful activity, testing of third-party systems, access to another user's private data, or disruption of AuctionVerse.