Security and responsible disclosure

1.1We take the security of our website, our games and our players seriously. If you think you have found a weakness, we want to hear about it, and we’ll work with you to fix it.

2.1Email hello@lacspace.com with the subject “Security”.

2.2Please report privately and don’t share details publicly or with others until we have fixed the issue, or agreed a date with you.

• The website address, game and version, or endpoint affected.
• Clear steps to reproduce the issue.
• What an attacker could do with it, and how you found it.
• A proof of concept, screenshots or a short recording, if you have one.
• How we can reach you, and whether you’d like to be credited.

• We’ll acknowledge your report.
• We’ll keep you updated while we look into it and fix it.
• We’ll tell you when it is fixed, and credit you if you’d like.

5.1If you follow the rules on this page and act in good faith, we won’t take legal action against you for your research, and we won’t ask anyone else to.

• Only use accounts you own or have permission to test with.
• Don’t view, change or keep other people’s data beyond the minimum needed to show the issue, and delete anything you collected.
• Don’t disrupt our services or other players: no denial of service, spam or mass automated testing.
• Don’t try to trick, phish or pressure our staff or players.
• Give us reasonable time to fix the issue before you talk about it.

7.1This website, our games (Ludo Fighters, NPL Cricket League and Game Collection) and the websites and servers we run for them.

• Denial-of-service, load or brute-force testing.
• Social engineering, phishing or physical attacks.
• Services we don’t run, such as app stores and hosting platforms. Please report those to their owners.
• Reports from automated scanners without a working example.
• Missing best-practice headers or settings with no real impact.
• Self-XSS, clickjacking on pages with no actions, and issues that need a rooted or already-compromised device.
• Cheating in a game without a security weakness behind it. That belongs under fair play.

9.1We don’t run a paid bug bounty, and we can’t promise a reward. With your permission, we’re happy to thank you by name once the issue is fixed.