Reporting a security problem

1How to report something

In plain EnglishEmail us, tell us what you found, and tell us how to see it for ourselves.

Send it to support@kovengames.com with "security" at the start of the subject line. That routes it away from the ordinary support queue and to somebody who can act on it.

A report we can reproduce gets fixed in days. A report we cannot gets a reply asking for more, which costs both of us a week. The more of the following you can give us, the faster this goes.

• What you found, in a sentence, before the detail.
• The exact steps to reproduce it, including the room code, deck or account you used.
• What an attacker gets out of it. A crash and a data leak need different answers from us.
• Anything you think we should not do, such as an account we should not delete because it is your proof.
• How you would like to be credited, or that you would rather not be.

If what you have found is being actively exploited, say so in the subject line. We will treat it as an incident rather than as a report.

2What happens next

In plain EnglishA person replies within three working days, we tell you what we think it is, and we keep you posted until it is fixed.

If we disagree about how serious something is, we will say why rather than quietly downgrading it. You are welcome to disagree back.

3Our promise to you

In plain EnglishResearch in good faith under this policy is authorised. We will not sue you, and we will not report you.

We consider security research carried out in line with this policy to be authorised access. We will not bring a claim against you under the Computer Misuse Act 1990 or any equivalent law elsewhere, we will not report you to the police, and we will not contact your employer or your internet provider about it.

If a third party brings a claim against you for work you did under this policy, tell us and we will make it clear that your research was authorised.

This promise covers research done in good faith. It stops covering you at the point you take somebody else’s data, damage something, or use what you found for anything other than telling us about it.

4What is in scope

In plain EnglishThe apps, the website, the game servers and the database. If in doubt, ask.

We care most about anything that reaches a room somebody was not invited to, anything that shows a player content that has not been moderated, anything that reveals personal data about another player, and anything that lets somebody act as a moderator when they are not one.

5What is out of scope

In plain EnglishFindings from a scanner with no working attack behind them, and anything that needs us to attack our own players.

We will read everything, but the following will usually get a polite no rather than a fix. None of it is a rule about what you may look at. It is a description of what we already know.

• Output from an automated scanner with no demonstrated impact attached.
• Missing security headers, cookie flags or TLS configuration with no working attack behind them.
• Rate limits you got past by using a lot of different addresses. We know, and stopping that is a job for the network in front of us.
• The publishable key that ships in the apps. It is meant to be public, and row level security is what stands behind it.
• Anything that needs physical access to somebody’s unlocked phone.
• Reports that Koven does not implement a feature you would like it to.

6What we ask of you

In plain EnglishUse your own accounts, take only what you need to prove it, and give us a chance to fix it first.

• Test against your own accounts, your own rooms and your own decks. Children use this product, and a room you were not invited to has real people in it.
• Take the minimum you need to demonstrate the problem, then stop. If you reach personal data, stop straight away and tell us what you reached rather than how much of it you could have taken.
• Do not run denial of service tests, do not send bulk automated traffic, and do not spam the report or waitlist forms.
• Do not use social engineering against our staff, our suppliers or our players.
• Give us ninety days before publishing, and talk to us if you need to move that date.

If you break something by accident, tell us. We would far rather hear it from you than find it ourselves.

7How we build for this

In plain EnglishServer authoritative gameplay, row level security on every table, and content that is private until a person has reviewed it.

Some context, so a report can be aimed at the interesting parts. The client never decides scores, phases or timers: if a client could lie about it, the server owns it. Every table that holds anything belonging to a person has row level security on it, and the negative case is tested rather than assumed.

Everything anybody writes starts private and unapproved. Nothing a player has made is visible to a stranger until it has been through moderation, which is the promise the whole product rests on.

If you find a way around either of those two, that is the report we most want to receive.