Security

Email joe@proslotbos.com → Privacy Policy

How to report

Email joe@proslotbos.com. Tell us what you found, where (the address, or the app and screen), the steps to reproduce it, and what someone could do with it. Screenshots or a short recording help.

If you came across anyone else's personal data, describe it in your report rather than including it.

What is covered

• proslotbos.com and its subdomains, including the ProSlot sign-in pages
• The ProSlot API that our sites and apps call
• The websites and mobile apps we build and run for our customers, which sign in through ProSlot

Not covered: services we use but do not run, such as Stripe, Google Cloud and Firebase, or Amazon (please report those to them), and a customer's own systems that we do not run.

While you test

• Use only accounts you own. Do not sign in as anyone else or guess passwords.
• If you reach someone else's data, and above all anything about a child, stop there. Do not download, keep or share it, and tell us right away. Look at no more than you need to show the problem.
• Do not change or delete anything that is not yours.
• No denial of service, no high-volume automated scanning, no spam, and no social engineering of our staff, our customers or the families they serve.
• Keep the problem between us until it is fixed, and talk to us before publishing anything. We ask for up to 90 days.

What we will do

• Reply within three business days to confirm we have your report.
• Keep you posted while we work on it, and tell you when it is fixed.
• Credit you by name when we talk about the fix, if you would like that.

We do not run a paid bug bounty.

Good-faith research

If you follow this policy, we will treat your research as authorized, work with you to understand and fix the problem, and will not pursue legal action against you for it. If you are not sure whether something is allowed, ask us first.

Machine-readable contact details are in /.well-known/security.txt.