Security Vulnerability Disclosure — TopX Casino
Last reviewed: 2026-09-21 · Reports: cybersecurity@topx.one
1. Reporting a vulnerability
Send your report to cybersecurity@topx.one. This is the only address we monitor for security issues. Messages sent to support, to individual staff members or through social media are not logged as reports, carry no priority and cannot earn a reward.
Please include:
- the affected asset — domain, URL, endpoint or application;
- what the issue is and what an attacker could do with it;
- steps we can follow to reproduce it, including any required roles or preconditions;
- a proof of concept, no larger than needed to show the problem;
- supporting screenshots or a short video, if they help.
Write in English. One issue per report.
2. Systems covered
Covered
topx.one— the main domain*.topx.one— all subdomains of the main domain
This policy covers only digital assets that TopX Casino owns, operates or maintains, and for which TopX Casino is able to authorize security testing.
Not covered
- Anything not named above.
- Equipment and assets belonging to other parties.
- Partner and third-party services, including SaaS, even when you reach them on a TopX domain or inside our product.
- Mirrors, archives and copies we do not run.
- Staging, demo and pre-production environments that are not named above.
If you find something in a system we do not operate, please report it to whoever does.
The presence of a security.txt file on a host does not bring that host into scope. The list above is what counts.
3. Testing boundaries
Please do not:
- run denial of service, load or stress tests;
- attempt social engineering against staff, contractors or users, including phishing, vishing and smishing;
- seek physical access to premises or hardware;
- run automated scans that generate heavy load or noise;
- alter, delete or extract data belonging to other people;
- keep access once you have demonstrated an issue, or plant backdoors or web shells;
- attempt extortion, threaten disclosure, or impose deadlines on us under pressure;
- test using accounts that are not yours.
Should you reach personal data, payment information or internal systems, stop at once, tell us, and delete anything you obtained when we ask, confirming that you have done so.
4. What we do in return
Report something under this policy and you can expect us to:
- acknowledge it and work with you to confirm what you have found;
- tell you how the work is progressing;
- fix confirmed issues as quickly as our operational constraints allow;
- apply the safe harbor in Section 8 to your research.
| Stage | Target |
|---|---|
| Acknowledgment | 2 business days |
| Triage and scope decision | 7 business days |
| Decision on reward | 21 business days from validation |
| Payment | 10 business days after the decision and completion of checks |
| Confirmation of the fix | once deployed |
5. What we ask of you
- Stay within this policy; if it conflicts with our other terms, this policy governs.
- Tell us what you have found without delay.
- Do not compromise anyone's privacy, disrupt our services, destroy data or degrade the experience of our users.
- Keep the discussion to the reporting address above.
- Do not go public without our prior written approval.
- Stay inside the covered systems.
- If an issue exposes data, look at no more than you need for a proof of concept, and stop and report immediately if you run into personal data, payment information or anything else confidential.
- Use only accounts you own or have explicit permission to use.
- Do not attempt extortion.
6. Bounty
We pay on impact, not on a CVSS number. The final call on severity and amount is ours.
| Severity | Examples | Range |
|---|---|---|
| Critical | Remote code execution, manipulation of balances or payouts, bypass of the payment flow, large-scale exposure of personal data, control of an administrative interface | $1,200 – 2,600 |
| High | Account takeover with no user interaction, IDOR reaching other users' accounts or documents, SQL injection, authentication bypass, SSRF into internal infrastructure | $450 – 1,300 |
| Medium | Stored XSS behind authentication, abuse of promotional or bonus logic, exposure of a limited data set | $200 – 500 |
| Low | Reflected XSS, CSRF on actions of low consequence, small logic flaws | $75 – 175 |
We pay more for a well-written report, for a chain of issues combined into real impact, and for a workable fix. We pay less where exploitation needs unusual preconditions, depends on user interaction, or is unlikely to be achievable in practice.
Outside the bounty
- SPF, DKIM or DMARC records that are missing or misconfigured;
- absent security headers or cookie flags, with no impact shown;
- clickjacking where no sensitive action is involved;
- self-XSS and anything requiring the victim to paste code themselves;
- version and banner disclosure with no working exploit;
- scanner output we cannot reproduce as an exploitable issue;
- enumeration of users, emails or usernames;
- missing rate limits with no demonstrated harm;
- issues in services operated by someone else;
- anything needing root, a jailbroken device, physical access or an obsolete browser;
- open redirects that do not escalate privilege or capture a token;
- credentials taken from third-party breach dumps.
7. Duplicates, eligibility and appeals
Order of arrival. The first report to reach cybersecurity@topx.one takes priority and is the one eligible for payment. Later reports of the same issue are duplicates. Anything already known to us internally, from a contractor assessment or through another channel, counts as known and is not eligible.
Duplicate decisions are ours and are final.
Appeals. If you disagree, write to cybersecurity@topx.one with Appeal: <report ID> in the subject line within 10 business days. We will reply within 15 business days.
Who cannot be paid. We are unable to pay a reward where the researcher is a current or former employee or contractor of TopX Casino (within 12 months of the engagement ending); is resident in a jurisdiction subject to restrictions preventing payment; is a minor without a guardian's consent; has breached Section 3; has disclosed the issue without our written approval; or has not completed identity verification and screening.
We also reserve the right to stop reviewing reports and to withhold rewards where a researcher sends systematic low-quality or machine-generated submissions, applies pressure, or breaches the testing boundaries.
8. Safe Harbor
When conducting vulnerability research, according to this policy, we consider this research conducted under this policy to be:
- Authorized concerning any applicable anti-hacking laws, and we will not initiate or support legal action against you for accidental, good-faith violations of this policy;
- Authorized concerning any relevant anti-circumvention laws, and we will not bring a claim against you for circumvention of technology controls;
- Exempt from restrictions in our Terms of Service (TOS) and/or Acceptable Usage Policy (AUP) that would interfere with conducting security research, and we waive those restrictions on a limited basis; and
- Lawful, helpful to the overall security of the Internet, and conducted in good faith.
You are expected, as always, to comply with all applicable laws. If legal action is initiated by a third party against you and you have complied with this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through one of our Official Channels before going any further.
Note that the Safe Harbor applies only to legal claims under the control of the organization participating in this policy, and that the policy does not bind independent third parties.
9. How payment works
Rewards are set in USD and paid in cryptocurrency.
- Asset and network: USDT over TRON (TRC-20) as standard. Where a reward is $500 or above we can use Ethereum (ERC-20) if you would rather. Those are the only two networks we send on — USDT sent over anything else is unrecoverable.
- Amount: rewards are set in USD and paid one-for-one in USDT, so no exchange rate comes into it.
- Network fees: ours to cover. What we agree is what lands in your wallet.
- Your address. Send us a receiving address once your report has been validated. We will confirm it with you separately before transferring. An address included in the original report, or one changed partway through a thread, is not used without that separate confirmation.
- No reversals. Crypto transfers are final. The address you give us is your responsibility, and funds sent to a wrong address cannot be recovered.
- Checks. We verify identity and screen both the researcher and the receiving address before paying. An address frozen or blacklisted by the asset issuer, or one that fails sanctions screening, cannot be paid. Where a check does not pass we will decline and tell you.
- Tax. Taxes and other mandatory charges are handled under applicable law; where required, TopX Casino acts as a withholding agent.
Data you give us for payment is used only to run this program and to meet tax reporting obligations.
10. Going public
Please hold off on publishing until we have approved disclosure in writing. There is no fixed window after which approval is presumed to have been given.
Once a fix is out we are happy to agree on what you publish, and to name you on our hall of fame if you would like that.
11. Revisions
We may revise this policy. Whichever version was in force when your report arrived is the one that applies to it.