Legal
Security
How to tell us something is broken, and the promise that it will not cost you anything to do it.
Provisional: this document is not approved yet
Everything below is a draft. It becomes the studio's approved position only when every administrator has signed this exact version in the client area. Until then, read it as an accurate description of what we do and intend, not as a document anybody has signed off.
Written in-house, not reviewed by a lawyer, and no Maltese entity exists yet to be a party to it. What approval means here
If you have found a weakness in anything we run, we want it and we will not make you regret sending it. This page says where to send it, what is in scope, what we will do, and what we will not do to you.
An operator's security team can also point their questionnaire here. The section on where security stands today sets out what has been tested so far, which is less than you might hope.
Safe harbour
Report in good faith and nothing happens to you
If you act in good faith under this page, we will not report you to law enforcement, will not bring a civil claim against you, will not complain to your employer or your university, and will not treat your research as a breach of our terms of use. If somebody else brings a claim about research that was within this policy, we will say publicly that it was authorised.
Good faith means: you stopped as soon as you had demonstrated the problem, you did not take or keep data that is not yours, you did not degrade the service for anybody else, you did not use the finding for anything other than reporting it, and you gave us a reasonable chance to fix it before telling anyone else.
This is a commitment by the studio behind Getaway Gaming about what we will do, and it cannot bind a third party: an operator, a hosting provider or a prosecutor. It covers systems named as in scope below and nothing else.
In scope
| What | Including |
|---|---|
| This website and everything under its domain | Including the game demos and the one-page game sheets. |
| The client area and its sign-in | Authentication, authorisation, and anything that gets you data your role should not reach. |
| The game server and its API | The round protocol, the session and launch flow, idempotency, replay, and anything that lets a client influence an outcome it should not. |
| The random number generator and the provable-fairness scheme | The commitment, the derivation, the per-game domain separation, and the seed release. This is the most valuable thing you could break here and the thing we most want to hear about. |
| The published figures | A return, a hit rate or a maximum win on this site that its own certification pack does not support is a defect in this class, not a typo. Report it here. |
Out of scope
| What | Why |
|---|---|
| Anything belonging to a casino | If you found it on an operator's site, it is theirs. We will forward a report if you ask and we will not act on it ourselves. |
| Denial of service, volumetric testing and load testing | Do not. It proves something everybody already knows and it takes the thing down for other people. |
| Social engineering, phishing and physical access | Not in scope, and not something we will treat as research. The people here are not a test surface. |
| Findings from a scanner, with no demonstrated impact | A missing header, a cipher suite, a version banner, an SPF nit. Send them if you like and they will be read; they will not be prioritised and they will not be credited. |
| Third-party services we use | Report those to their own programmes. We will tell you which one it is if it is not obvious. |
How to report
Email hello@getawaygaming.com with "SECURITY" in the subject line. One inbox, read by people rather than by a ticketing system, and a report marked that way is routed as one.
Tell us what you found, where, what it lets somebody do, and the minimum steps to see it. A video is welcome and a proof of concept is better. Write in English or Dutch; both reach somebody who will read them properly.
We do not publish a PGP key yet. If you need encryption for something sensitive, say so in a first mail with no detail in it and we will agree a channel before you send anything. A key is only worth publishing once its private half is kept somewhere only a person controls, and a key generated into a code repository would not meet that bar. There will be none until there is somewhere to keep it.
What we do with it, and when
| Step | Commitment |
|---|---|
| We acknowledge | Within three working days, from a person, with a name. |
| We triage | Within ten working days: whether it reproduces, how bad it is, and what we are going to do. |
| We fix | On a timetable set by the severity, and we tell you what it is rather than leaving you to ask. Anything that affects a round's outcome or a player's money goes to the front of everything else. |
| We tell you when it ships | And if it is the kind of thing a laboratory or a regulator needs to know about, we tell you that too, because it changes how long the fix takes to become real. |
| We credit you | By the name or handle you choose, on this page, unless you would rather we did not. There is no bounty (see below). |
| We agree a disclosure date | Ninety days by default, sooner if it is fixed sooner, and we will not ask you to sit on something indefinitely. If we disagree about the date, you are free to publish after ninety days and this policy still protects you. |
There is no bounty
There is no bug bounty and no reward budget. We are a studio in build with no revenue, and a published bounty we could not pay would be worse than none: it would reach precisely the researchers who are counting on it.
What we can offer is a fast reply from somebody technical, credit on this page in whatever name you choose, a straight answer about what we did with it, and a reference for your own record if you want one. When there is a budget this section changes and the date it changed will be on it.
Credits
Nobody yet. The first person to send us something will be the first name here, in place of this paragraph.
Where security stands today
The part an operator's questionnaire asks about.
No penetration test has been performed against anything here, by anybody, ever. No external security audit, no red team, no code review by a third party. That is the largest gap in this studio's assurance, and it is on our list of things that need a person and a budget to close.
What does exist: every database table denies by default and access is a role with an author and an end date, production changes need a second person, what a person read is written to an append-only log, the release's own hashes are re-checked by the server at boot and every day after, and a round from two years ago can be replayed from its committed seed and compared against what was recorded. Those are controls a licence is granted against, and none of them is a substitute for somebody competent trying to get in.
Backups have never been restored and there is no tested disaster recovery plan. Point-in-time recovery on the production database is step one and performing a restore and timing it is step two, and neither has been done.
Which instruments reach us
Two instruments are worth naming, because an operator's questionnaire will ask about both. The Cyber Resilience Act reaches software placed on the market as a product rather than software delivered as a service: our games are served from our own infrastructure, so today we are outside it. Handing an operator the certified client as a build would change that answer and bring a reporting duty with it.
NIS2 does not list gambling among its sectors, so it does not reach us directly. What reaches us is being in the supply chain of entities it does reach. That is why this policy is laid out as answers to their questions instead of as a contact form.
Elsewhere
This policy is also published at /.well-known/security.txt in the format RFC 9116 defines, so a scanner or a researcher's tooling finds it without reading a web page.
Provisional until every administrator has approved this version. Written in-house, not reviewed by a lawyer, and no Maltese entity exists yet to be a party to it.