Responsible vulnerability disclosure policy

Gamechanger LLP pays close attention to the security of its websites, software products and information systems.

Despite the security measures taken, no information system can be considered absolutely invulnerable.

If a researcher, user, client or any other person has discovered a potential vulnerability in a Gamechanger system, we ask that it be reported responsibly so that our team can verify the issue and take the necessary measures.

This Policy sets out:

• where to send information about a vulnerability;
• what information should preferably be provided;
• which actions are permitted;
• which actions are prohibited;
• how Gamechanger handles reports;
• how public disclosure of information is governed.

The Policy applies primarily to public websites owned or operated by Gamechanger LLP, including:

• gamechanger.kz;
• gamechangercraft.kz;
• gamechangerweb.kz;
• their subdomains;
• public Gamechanger APIs;
• public Gamechanger services and applications, unless a separate security policy has been established for them.

The existence of this Policy does not constitute automatic permission to test any systems, infrastructure, servers or products of Gamechanger.

If a resource is not expressly listed or the ownership of a system is unclear, permission must be requested before any active testing.

This Policy does not grant permission to test the systems of Gamechanger clients.

Even if a product:

• was developed by Gamechanger;
• is maintained by Gamechanger;
• contains a reference to Gamechanger;
• is technically connected to Gamechanger infrastructure,

it may belong to another legal entity.

Researching such a system requires the permission of its owner.

If a potential vulnerability is discovered by chance, the information may be sent to Gamechanger, and we will endeavor to pass it on to the relevant owner or responsible specialist.

Reports may concern, in particular, potential:

• access control errors;
• IDOR;
• authorization flaws;
• authentication bypass;
• SQL Injection;
• Command Injection;
• XSS;
• SSRF;
• CSRF;
• insecure file uploads;
• misconfigurations;
• leakage of secrets;
• exposed API keys;
• insecure APIs;
• session management errors;
• personal data leaks;
• disclosure of confidential information;
• misconfiguration of cloud infrastructure;
• vulnerable dependencies;
• business logic errors;
• privilege escalation opportunities;
• critical issues in AI interfaces;
• disclosure of internal AI context;
• AI access to another user’s data;
• other issues capable of materially affecting the confidentiality, integrity or availability of a system.

Send an email to: Developers@Gamechanger.kz

Please include, where possible:

• the URL or name of the affected resource;
• the type of the suspected vulnerability;
• a brief description;
• steps to reproduce;
• expected behavior;
• actual behavior;
• potential impact;
• the date and time of discovery;
• the browser, device or other technical context, if relevant;
• the minimum evidence necessary to demonstrate the existence of the issue.

If necessary, you may attach:

• a screenshot;
• a safe proof of concept;
• an HTTP request;
• an excerpt of the server response;
• logs that do not contain unnecessary personal data;
• a video of the reproduction.

The researcher should seek to confirm a potential vulnerability with the minimum possible impact.

If, to confirm it, it is sufficient to:

• observe that access is possible;
• obtain a single test object of one’s own;
• confirm that an action is possible without actually performing it,

exploitation should not be continued.

The purpose of good-faith research is to demonstrate the issue, not to prove how much damage could be caused.

If you accidentally discover another person’s personal data during your research: do not continue examining it.

You should not:

• download data sets;
• copy a database;
• make additional requests to other people’s records;
• disseminate the information found;
• publish screenshots showing exposed personal data.

Record only the minimum amount of information necessary to confirm the issue and report it to Gamechanger.

If a vulnerability has accidentally exposed:

• source code;
• contracts;
• trade secrets;
• keys;
• internal documents;
• configuration;
• client data;
• private repositories,

the researcher must stop obtaining further information once the issue has been sufficiently confirmed.

The information obtained must not be used for any other purpose.

If you discover:

• an API key;
• a password;
• a token;
• a private key;
• a credential;
• a cloud infrastructure secret,

do not use it to explore additional systems.

In the report, it is sufficient to state:

• where the secret was found;
• what type of system it presumably relates to;
• the minimum information confirming its potential validity.

Gamechanger will carry out the rotation and internal review on its own.

Within the scope of this Policy, reasonable actions with minimal impact are permitted, for example:

• studying publicly available information;
• analyzing the client side of the website;
• checking your own data and your own user session;
• safely verifying a suspected error;
• creating a minimal proof of concept;
• sending a limited number of requests necessary for reproduction;
• analyzing public HTTP headers and configuration;
• reporting an issue discovered by chance.

Each situation is assessed taking into account the nature of the actions and their impact.

Mass automated scanning is not considered automatically permitted under this Policy.

The reason is simple: even a standard scanner can:

• create significant load;
• trigger blocking;
• damage an unstable function;
• generate a large number of false security events.

Intensive automated testing requires prior approval.

If a suspected vulnerability concerns access to another user’s objects, we recommend using:

• your own test accounts;
• test data;
• a minimal safe scenario.

If registration is not available on a particular service and the hypothesis cannot be verified safely, it is better to report the potential issue without further exploitation.

Gamechanger also accepts reports of potential issues in AI interfaces.

For example:

• disclosure of another user’s data;
• access to internal documents without the appropriate rights;
• disclosure of secret keys;
• bypassing restrictions on access to the knowledge base;
• obtaining confidential system information;
• the possibility of using AI as a path to unauthorized access;
• dangerous errors in the integration of AI with external tools.

At the same time, merely receiving an AI response that appears unusual or incorrect does not in itself indicate a security vulnerability.

Prompt injection research is permitted only to the extent that it does not create a real risk to data or infrastructure.

Prompt injection must not be used to:

• obtain other people’s personal data;
• obtain keys;
• bypass actual authorization;
• perform unauthorized actions in external systems;
• modify or delete data.

If you find a way to make the AI disclose its internal instructions without access to sensitive data, you may report it as a potential issue.

A discovered vulnerability must not be used:

• to obtain commercial benefit at the expense of users;
• for blackmail;
• for extortion;
• to obtain services free of charge by bypassing payment mechanisms;
• to modify other people’s data;
• to obtain competitive information;
• to attack third parties.

Responsible Disclosure ends where exploitation for gain or harm begins.

We ask that you do not publish technical details of a vulnerability immediately after discovering it.

Before public disclosure, we recommend giving Gamechanger reasonable time to:

• confirm the issue;
• determine its impact;
• develop a fix;
• verify the fix;
• notify affected persons, if necessary;
• take the mandatory actions required by law.

If a researcher wishes to publish information about a vulnerability, we recommend agreeing in advance on:

• the publication date;
• the level of technical detail;
• the need to redact personal data;
• the need to redact infrastructure details;
• the status of the fix.

Gamechanger does not seek to prohibit good-faith disclosure of an issue indefinitely.

The aim is to prevent a situation in which instructions for exploiting a vulnerability are published before users have been protected.

Potentially critical reports may include:

• remote code execution;
• complete authorization bypass;
• a mass leak of personal data;
• access to production infrastructure;
• compromise of an admin panel;
• obtaining critical secrets;
• the ability to modify significant data;
• a vulnerability that allows a large number of users to be attacked.

In such cases, please state in the email subject line: SECURITY — CRITICAL

After receiving a report, Gamechanger may:

1. register the report;
2. carry out an initial assessment;
3. attempt to reproduce the issue;
4. determine the level of risk;
5. request additional information;
6. develop a fix;
7. verify the fix;
8. take the necessary incident response actions.

Gamechanger seeks to acknowledge receipt of quality vulnerability reports.

The speed of further communication depends on:

• the severity of the issue;
• the complexity of reproduction;
• the affected system;
• the need to involve a third-party vendor;
• the nature of the required fix.

This Policy does not establish a guaranteed SLA for unpaid reports from researchers.

The assessment of an issue may take into account:

• exploitability;
• the privileges required;
• the need for user interaction;
• the amount of data accessible;
• the potential damage;
• the number of affected users;
• the complexity of the attack;
• the presence of compensating controls;
• the possibility of remote exploitation.

Generally accepted approaches, including CVSS, may be used for the technical assessment, but the final priority is also determined by the business context.

Several researchers may independently discover the same issue.

If a report describes a vulnerability already known to Gamechanger, it may be marked as a duplicate.

This does not mean that the report was useless.

Some reports may be classified not as a vulnerability but as a recommendation to strengthen security.

For example:

• the absence of a certain optional security header;
• disclosure of information that is already public;
• a theoretical attack without a practically feasible scenario;
• a software version without a confirmed applicable vulnerability.

Such reports may still be useful and will be reviewed by the team.

As of this version, the publication of this Policy does not mean that a public Bug Bounty Program exists and does not guarantee a monetary reward.

If Gamechanger decides to pay a reward for a particular report, this may be determined individually or within a separate program.

A researcher should not assume that Gamechanger has an obligation to pay for research merely because a report has been submitted.

This Policy is not a contract for:

• penetration testing;
• security audit;
• red team;
• load testing;
• comprehensive infrastructure scanning.

Such work requires separate written approval.

When assessing a researcher’s actions, Gamechanger takes into account whether the researcher:

• acted for the purpose of reporting the issue;
• limited the impact;
• stopped the research after sufficient confirmation;
• refrained from using other people’s data;
• refrained from intentionally causing damage;
• refrained from attempting to obtain an unlawful benefit;
• reported the issue responsibly.

This Policy describes the preferred procedure for responsible interaction with Gamechanger.

It does not grant permission to perform actions prohibited by the legislation of the Republic of Kazakhstan and cannot override legal requirements.

If a researcher is unsure whether a particular action is permitted, it is wiser to stop and request permission before performing it.

A researcher may provide:

• a name;
• a pseudonym;
• an organization;
• a contact for follow-up.

Gamechanger uses the contact details provided to process the report and communicate about the issue.

If a researcher asks not to be named in any publication of information about the fix, Gamechanger will take such a request into account within reasonable limits.

With the researcher’s consent, Gamechanger may publicly thank them for a responsible report.

For example, the following may be published:

• name;
• pseudonym;
• profile;
• organization name.

Without an appropriate basis, a researcher’s personal data shall not be published merely because they reported a vulnerability.

Personal data obtained in connection with a vulnerability report is processed in accordance with:

• the Gamechanger Privacy Policy;
• the legislation of the Republic of Kazakhstan.

Data may be retained to the extent necessary for:

• investigation;
• remediation of the issue;
• ensuring security;
• preventing repeat incidents;
• fulfilling legal obligations.

If a report indicates a possible personal data security breach, Gamechanger carries out a separate assessment of the incident and takes the actions required by the legislation of the Republic of Kazakhstan and the Company’s internal procedures.

The researcher should not independently notify potentially affected users before coordinating with Gamechanger, unless the absence of such notification poses an immediate threat to a person or the law requires otherwise.

Some issues may reside:

• in a third-party library;
• in a cloud service;
• with an AI provider;
• in an analytics system;
• in other external technology.

In such a case, Gamechanger may:

• take compensating measures;
• update the component;
• disable the function;
• notify the relevant vendor;
• provide the vendor with the necessary technical information.

In such a transfer, the personal data of the researcher or users shall not be disclosed unless necessary.

Critical secrets should not be sent through an unsecured channel if indicating where they were found is sufficient to describe the issue.

Gamechanger may update this Policy in connection with:

• changes to the infrastructure;
• the launch of new services;
• changes in legislation;
• the development of AI;
• changes to information security processes;
• the launch of a separate Bug Bounty Program.

The current version is published on the websites of Gamechanger.