SECURITY
Reporting a security issue
If you find a security problem in any Cup Code system, please don’t disclose it publicly before giving us a chance to review it.
How to report
- Describe the issue and where you found it, with reproduction steps if possible.
- Don’t access data that isn’t yours, and don’t disrupt the service while testing.
- Give us reasonable time to fix it before any disclosure.
- Use the security report form so the details reach us privately with a reference number.
Scope
In scope
- This website and its subdomains
- The admin panel and site forms
- Cup Code e-mail and official accounts
Out of scope
- Denial of service or flooding
- Social engineering or phishing against us or anyone else
- Our providers’ systems (report to them directly)
- Automated scanner output with no real impact
Responsible testing rules
- Don’t view, keep, change or delete data that isn’t yours.
- Stop as soon as the issue is proven; don’t escalate the exploit.
- Don’t disrupt the service or affect visitors.
- Give us reasonable time to fix before any public disclosure.
Our commitment
- We acknowledge your report and give you a reference.
- We review it and tell you the outcome once fixed.
- We thank you publicly if you wish, after the fix.
There is no bug bounty program at the moment. We still value every responsible report and will credit you publicly if you wish.
Unauthorised access to systems is a crime under Saudi Arabia’s Anti-Cyber Crime Law. Following the rules above means you are acting in good faith, and we won’t pursue action against a researcher who follows them.