Security Policy

Security Policy

TournamentSuite takes the security of our systems and the data of our users seriously. We are committed to working with security researchers to identify and resolve vulnerabilities responsibly.

Responsible Disclosure

If you discover a potential security vulnerability, please report it to us privately before disclosing it publicly. We ask that you give us a reasonable amount of time to investigate and address the issue before any public disclosure. We will acknowledge your report within 48 hours and aim to provide a resolution timeline within 5 business days.

Scope

• Web applications and public APIs
• Player and organizer-facing interfaces
• Infrastructure operated by TournamentSuite

Out of Scope

• Social engineering attacks against staff or users
• Denial-of-service or resource exhaustion attacks
• Third-party services and integrations not under our control

Process

1. Report the vulnerability privately before any public disclosure
2. Include clear steps to reproduce, proof-of-concept, and potential impact
3. Allow us reasonable time to investigate and remediate before disclosure
4. We will acknowledge receipt within 3 business days and keep you informed of our progress

Hall of Thanks

We are grateful to the security researchers who have helped make TournamentSuite safer. If you would like to be listed here after a successful disclosure, please let us know in your report.