Security

The security and privacy of our players are extremely important to us. This program enables the security research community to help us identify and resolve vulnerabilities responsibly. We appreciate your efforts in keeping our community safe.

Please read this page in its entirety before submitting a report. If you have questions, reach out to security@kordu.gg.

• Reports MUST be sent to security@kordu.gg
• All reports must include clear reproduction steps
• You agree not to publicly disclose vulnerabilities until we have addressed them
• Testing must be done through your own accounts only
• Do not access or modify other users' accounts or data without explicit consent
• Act in good faith - avoid privacy violations, data destruction, or service disruption

To help us triage and respond quickly, please include:

• Contact Details - Your name, email, and preferred contact method
• Vulnerability Type - Category (e.g., XSS, SQL Injection, RCE, Auth Bypass)
• Affected Asset - Which system is affected (see Scope section)
• Description - Technical details and root cause analysis
• Location - URL/endpoint, file path, API route, or exposed port
• Reproduction Steps - Clear, numbered steps to reproduce the issue
• Proof of Concept - Screenshots, videos, or code demonstrating the vulnerability
• Impact Assessment - What an attacker could achieve by exploiting this
• Suggested Remediation (Optional) - Your recommendations for fixing the issue

The following assets are in scope for this program. Vulnerability severity is determined by impact, not by which asset is affected.

The following types of reports are out of scope:

• Denial of Service (DoS/DDoS) attacks against infrastructure
• Brute forcing or credential stuffing
• Spam or social engineering attacks
• Reports that do not pose any security or gameplay risk
• Account or email enumeration
• Email SPF, DKIM, and DMARC configuration issues
• Self-exploitation (vulnerabilities only exploitable by the victim)
• Minor visual glitches or cosmetic bugs
• Gameplay balance suggestions (not exploits)
• Rate limiting or throttling issues
• Missing security headers without demonstrated impact
• Clickjacking on pages with no sensitive actions
• CSRF on logout or non-state-changing operations
• Vulnerabilities requiring physical access to a device

We use CVSS 3.1 (Common Vulnerability Scoring System) to assess severity. Final ratings consider both technical impact and business context.

We implement industry-standard practices to protect your data:

When conducting security research in accordance with this policy, we consider your research to be:

• Authorized concerning applicable anti-hacking laws - we will not initiate legal action for good faith violations
• Authorized concerning anti-circumvention laws - we will not bring claims for circumventing technology controls
• Exempt from restrictions in our Terms of Service that would interfere with security research
• Lawful, helpful to overall security, and conducted in good faith

If at any time you're uncertain whether your research is consistent with this policy, contact security@kordu.gg before proceeding.

We will not pursue civil action or initiate complaints to law enforcement for security research that represents a good faith effort to comply with this policy. We consider compliant activities to be “authorized” under the Computer Misuse Act 1990 (UK) and equivalent international laws.

If legal action is initiated by a third party against you for compliant activities, KORDU LTD will take steps to make known that your actions were conducted in accordance with this policy.

KORDU LTD reserves the right to make final determinations on whether submissions qualify under this policy.

We provide tools to help you secure your account:

• Two-factor authentication (2FA) via authenticator apps
• Login notifications for new devices
• Session management - view and revoke active sessions
• Secure password requirements
• Account recovery with identity verification

In the event of a security incident affecting user data:

1. Contain and assess the incident immediately
2. Notify affected users within 72 hours
3. Report to relevant authorities as required by GDPR
4. Conduct thorough investigation
5. Implement measures to prevent recurrence
6. Publish post-incident report when appropriate

We appreciate the security research community's efforts in helping us keep our platform safe. While we do not offer monetary rewards, valid vulnerability reports may receive:

• Public acknowledgement on our security page (with your permission)
• A thank-you message from the KORDU team
• Priority consideration for future community roles

We may modify or terminate this program at any time. KORDU LTD staff and family members are not eligible for acknowledgement.

For security inquiries or to submit a vulnerability report: