A2Z Vulnerability Disclosure Policy

Public policy version: 1.0
Effective date: 2026-10-01

1. Purpose

A2Z welcomes reports that help protect its users and services. This policy explains how to report a suspected security vulnerability, what testing is within scope, what conduct is prohibited, what a good-faith reporter may expect from gathron, and the conditions proposed for safe harbour.

This is a vulnerability disclosure programme, not a bug bounty. gathron does not operate a bug bounty and does not promise payment, gifts, employment, public credit, or another reward for a report.

2. Contact

Send reports to info@a2z.gathron.com. Do not send a vulnerability report through a player report, CALLSIGN, HELP, public social media, or a public issue tracker.

A report should include, where available:

• the affected host, endpoint, application version, and account type;
• a concise description and potential security impact;
• reproducible steps using the minimum proof necessary;
• relevant request identifiers, timestamps, screenshots, or redacted logs;
• whether personal data, payment state, another account, or service availability may be affected;
• actions already taken and whether testing has stopped; and
• a preferred contact method and whether the reporter requests acknowledgement by name.

Do not include passwords, one-time codes, full payment details, unrelated personal data, database dumps, access tokens, private keys, or more user data than needed to identify the issue. If highly sensitive material appears necessary, first request a protected transfer method from the security contact.

3. Systems in scope

Only the following gathron-managed public A2Z systems are proposed to be in scope:

• https://a2z.gathron.com;
• https://api.a2z.gathron.com;
• A2Z browser code delivered from those origins; and
• an A2Z native client only after gathron publicly identifies that exact application and version as supported by this policy.

Testing must use an account and data owned by the reporter unless gathron gives prior written authorization for a specific alternative. If there is doubt about ownership or scope, stop and ask before testing.

4. Systems and activities outside scope

The following are outside scope and are not authorized by this policy:

• Stripe, Resend, GMO Internet, Onamae.com, domain registrars, networks, app stores, operating systems, browsers, or any other third-party system;
• local devices, accounts, email addresses, payment methods, or data not owned by the reporter;
• physical access, social engineering, phishing, impersonation, bribery, threats, extortion, or harassment;
• denial of service, distributed denial of service, traffic flooding, resource exhaustion, destructive load testing, or deliberate degradation;
• password spraying, credential stuffing, brute force, automated account creation, mass scanning, or bypassing rate limits;
• malware, persistence, backdoors, lateral movement, command-and-control, destructive payloads, or modification or deletion of data;
• accessing, copying, downloading, retaining, altering, or disclosing another person’s data;
• changing purchases, refunds, entitlements, rewards, rankings, combat state, account status, or another authoritative record beyond the minimum test on the reporter’s own account;
• public disclosure, sale, transfer, or use of a vulnerability before coordinated disclosure; and
• testing after gathron asks the reporter to stop.

A finding about a third-party service should be reported under that provider’s policy. A2Z may also be notified if the third-party issue creates a direct A2Z impact, but this policy cannot authorize testing of the provider.

5. Rules for good-faith security research

For research to qualify as good faith under this proposed policy, the reporter must:

1. act solely to identify, report, and help correct a security weakness;
2. comply with this policy and applicable law;
3. avoid harm to users, privacy, data, funds, gameplay, infrastructure, and availability;
4. use the least intrusive method and stop after obtaining the minimum proof needed;
5. stop immediately if personal data, another account, payment information, secrets, or unexpected access becomes visible;
6. preserve no unnecessary data and securely delete any incidental copy after gathron confirms it is no longer needed;
7. report promptly and keep the issue confidential while remediation and coordinated disclosure are underway;
8. provide truthful information and cooperate reasonably with validation; and
9. never demand payment or another benefit in exchange for withholding disclosure, exploitation, or harm.

Discovery of a vulnerability does not authorize viewing other users’ information or expanding access to determine how much data is available. A redacted record showing that access would have been possible is preferred over retrieving the data.

6. Safe harbour

If a reporter makes a good-faith effort to comply with this policy, limits activity to the stated A2Z scope, and promptly reports the issue, gathron intends to treat that research as authorized by gathron and will not initiate legal action solely for that compliant research. If a third party initiates action and the reporter remained compliant, gathron may state that the activity was conducted under this policy.

This safe harbour does not bind law enforcement, regulators, prosecutors, courts, users, infrastructure providers, or other third parties; does not waive rights of affected people; and does not authorize conduct prohibited by applicable law. It also does not cover accidental activity after the reporter fails to stop, intentional harm, privacy invasion, extortion, or activity outside scope.

This safe harbour is only gathron’s statement of its own enforcement intentions. It is not immunity from civil, criminal, administrative, contractual, or third-party action. A reporter who is uncertain whether planned testing is authorized must request written authorization before testing; silence is not authorization. Applicable law always controls.

7. What reporters can expect

Subject to report quality, contact availability, workload, incident conditions, and legal restrictions, gathron intends to:

• acknowledge a report within 3 business days;
• provide an initial validation or request for information within 10 business days;
• keep the reporter reasonably informed of material progress;
• handle the report and reporter contact details on a need-to-know basis;
• avoid requiring a non-disclosure agreement merely to accept a report; and
• credit the reporter only with explicit mutual agreement and only where lawful and safe.

These are service targets, not guarantees. A2Z may prioritize active exploitation, user harm, payment risk, authentication bypass, remote code execution, or large-scale data exposure over lower-impact reports.

8. Coordinated disclosure

Do not publicly disclose or share exploit details until gathron confirms remediation and the parties agree on disclosure, or until another timeline has been reviewed under this section. Reports may require coordination with service providers, affected users, regulators, or law enforcement.

Proposed disclosure timeline and exception process: 90 calendar days after acknowledgement, with extensions by mutual agreement where remediation, third-party coordination, legal duties, or active exploitation require a different schedule

gathron may publish a security advisory, acknowledge a reporter, or decline public disclosure based on user safety, exploitability, remediation status, legal duties, and third-party coordination. A reporter must not identify affected users or publish personal data, credentials, payment information, secrets, or weaponized exploit material.

9. Duplicate, informational, and ineligible reports

A2Z may close a report as duplicate, not reproducible, intended behaviour, low-risk informational feedback, outside scope, or already known. This does not imply eligibility for payment or recognition. Automated scanner output without a demonstrated A2Z impact may receive no individual response.

10. Privacy and records

gathron may retain the report, contact details, technical evidence, correspondence, validation notes, remediation state, and disclosure decision for security, audit, legal, and abuse-prevention purposes. Do not submit another person’s personal data unless strictly necessary to report immediate harm. Applicable privacy rights and contact methods are described in the A2Z Privacy Policy.