comps.gg/security · responsible disclosure ← comps.gg
# Security & Responsible Disclosure

Last updated: 2026-07-21  ·  Contact: [email protected]  ·  Test target: demo.comps.gg

Report something real and in scope and we'll fix it fast, credit you, and pay cash for the serious stuff. No legal games — see Safe harbour.

## What's actually worth your time

These are the crown jewels. A working PoC against any of them is high severity and paid as such. Aim here, not at missing headers.

## Rewards

Fixed bands, paid in cash via PayPal. First valid report on an issue wins; dupes and known issues pay nothing. Final severity is ours to call, and we'll show our working — set by what you actually demonstrated on demo.comps.gg, not by the CVSS score, CWE list or ASVS clause you attach. A wall of references doesn't raise a finding; a working PoC does.

SeverityLooks likeReward
P1 · critical cash extraction, auth bypass, pre-pay outcome peeking, full account takeover £500–£1,000cash
P2 · high underpaying at checkout, reading another user's private data, stored XSS in an authed area £150–£300cash
P3 · medium lower-impact logic flaws, limited info disclosure, CSRF on a meaningful action £50–£100cash + credit on the wall
P4 · low/info best-practice findings with no demonstrated impact —hall of fame at our discretion, for findings we act on
## Scope
### In scope — test here
### Out of scope — don't

! go easy on the demo

The demo is a small, shared environment. Please don't brute-force, fuzz at volume, or run high-rate automated scans against it — you'll knock it over for everyone and trip its abuse protection, which just gets you blocked. Manual, targeted testing finds the good bugs anyway.

! white-label note

Many sites run our software for different operators. Test only against demo.comps.gg. If you think a bug hits a live operator, report it — don't reproduce it against real competitions or real customers. Those sites aren't ours to authorise you against.

## How to report
  1. Email [email protected] with the subject "Security Disclosure" — one issue per report. URL/endpoint, repro steps, and what an attacker gains. A short screen recording or curl sequence beats prose.
  2. We triage and rate it as soon as we reasonably can, usually within a few business days. Our first reply is the triage outcome — we don't send "we got it" acknowledgements, because answering those is time not spent triaging. If you sent it, we have it. No need to chase; we'll contact you at each stage from here.
  3. We fix, then pay the agreed reward by PayPal and (with your OK) add you to the wall. Please hold disclosure until the fix ships.

! write it like a human

Short and real beats long and generated. We want a few lines from a person who found and understood the bug: one issue, plain English, the exact requests, and what an attacker actually gains. Please don't:

## Safe harbour

Research in good faith and we've got your back.

If you make a sincere effort to follow this policy — in-scope targets only, don't pull more data than needed to prove the bug, don't degrade the service, don't disclose before we've fixed it — we will not pursue or support legal action against you, and we'll treat your work as authorised. If a third party comes after you over in-scope activity, we'll state on record that you acted within this policy. Unsure if something's allowed? Ask first: [email protected].

## security.txt

Lives on every site we run, so this policy is discoverable without sitting in anyone's nav. RFC 9116.

# https://comps.gg/.well-known/security.txt
Contact: mailto:[email protected]?subject=Security%20Disclosure:
Policy: https://comps.gg/security/
Acknowledgments: https://comps.gg/security/#hall-of-fame
Preferred-Languages: en
Canonical: https://comps.gg/.well-known/security.txt
## Hall of fame

Researchers who've helped keep comps.gg safe.

Offered at our discretion. Rewards, scope and terms may change; this page governs.  ·  [email protected]