Thank you for your interest in contributing to the security of our platform. Our Bug Bounty Program is designed to reward security researchers who responsibly identify vulnerabilities that could impact the confidentiality, integrity, or availability of our systems. The following sections outline the scope, reporting guidelines, and severity classifications.
Rewards and Inquiries
If you wish to know the exact reward associated with a submission or require additional details, please contact: bugbounty@winnerodds.com
Program Scope
We accept submissions for vulnerabilities that affect the security of:
- Core web applications and APIs Authentication and user management systems
- Public-facing services and infrastructure
This list is not exhaustive; any finding that may meaningfully impact security will be considered.
Out of Scope
The following will not be considered valid submissions:
- Social engineering attacks of any kind
- Denial-of-service attempts that impact real service availability
- Vulnerabilities affecting third-party services outside our control
- Excessive automated scanning or brute-force testing
- Reports without reproducible steps, or lacking a clear proof of concept.
Severity Levels and Criteria
Vulnerabilities are categorized based on their potential impact.
