Security Policy

Reporting a Vulnerability

If you discover a security vulnerability in the RecruitMyGame platform, please report it responsibly. We take all reports seriously and will respond promptly.

Send a detailed report to: security@recruitmygame.com

Please include:

• A clear description of the vulnerability
• Steps to reproduce or proof-of-concept (without causing harm)
• The affected component, URL, or endpoint
• Potential impact (what data or functionality could be affected)
• Your contact information for follow-up

Response Timeline

We will keep you informed throughout the process and credit your contribution if you wish.

Scope

The following are in scope for security research:

• recruitmygame.com and all subdomains
• jucoportal.recruitmygame.com and all subdomains
• The RecruitMyGame API endpoints
• Authentication and session management flows

The following are out of scope:

• Denial of Service (DoS/DDoS) attacks
• Social engineering of RecruitMyGame employees
• Physical attacks
• Third-party services (Supabase, Stripe, Vercel, Cloudflare) — report to them directly
• Issues requiring physical access to a user's device
• Vulnerabilities in outdated browsers or operating systems

Safe Harbor

We will not take legal action against researchers who:

• Make a good faith effort to avoid privacy violations and disruption of service
• Do not access, modify, or delete user data beyond what is needed to confirm the vulnerability
• Report findings promptly and allow reasonable time for remediation before disclosure
• Do not use the vulnerability for personal gain or to harm others

Encryption

For sensitive reports, you may encrypt your email using our PGP key (available on request via security@recruitmygame.com).

Automated Security Controls

Every pull request and push to main/staging runs the following automated checks. Findings surface in our CI pipeline and block merges on high/critical findings.