Security Disclosure Policy

Purpose

This policy gives security researchers a safe route to report vulnerabilities.

How to report

Email security@ivawin.com with:

• affected URL/feature
• vulnerability description
• steps to reproduce
• potential impact
• screenshots or logs, if safe
• your contact details

Rules for researchers

Please do not:

• access, modify or delete other users' data
• perform denial-of-service attacks
• use social engineering
• exfiltrate data
• publish details before IVAWIN has had a reasonable time to investigate
• test payment fraud or live draw manipulation

Our response

We aim to acknowledge reports promptly and provide updates where appropriate.

Scope

In scope: IVAWIN public website, APIs and account/admin flows. Out of scope: third-party services not controlled by IVAWIN, unless the issue directly affects IVAWIN users.