Vulnerability Disclosure Policy
Security is our business, and we welcome reports from researchers and anyone else who finds a potential vulnerability in OutcomeWon systems. If you act in good faith under this policy, we will work with you to understand and resolve the issue quickly.
How to report
Email info@outcomewon.com with "Security report" in the subject. Please include:
- The affected system or URL
- A description of the issue and its potential impact
- Steps to reproduce, or a proof of concept
- How we can reach you for follow-up
Our machine-readable contact details are published at /.well-known/security.txt (RFC 9116).
What to expect
- We aim to acknowledge your report within 3 business days.
- We will keep you informed as we investigate and fix the issue.
- With your permission, we are happy to credit you once the issue is resolved.
Scope
This policy covers outcomewon.com and its subdomains. It does not cover customer environments we operate on behalf of clients, or third-party services. Report issues in those to the respective owner.
Guidelines
- Do not access, modify, or delete data that is not yours, and stop testing once you have shown the issue.
- Do not degrade service: no denial-of-service, spam, or automated high-volume scanning.
- No social engineering, phishing, or physical testing.
- Give us reasonable time to fix the issue before disclosing it publicly.
Safe harbor
If you make a good-faith effort to comply with this policy, we consider your research authorized, will not pursue legal action against you for it, and will make this authorization known if a third party pursues action against you.