Topic: How best to report vulnerabilities? - page 2. (Read 659 times)

Nope. You will just make the casino exposed to multiple abuse once the bug is critical to their security. Reporting a bug should be in private through customer support or the official email to make it discreet to other players. I believe the OP main goal for creating this thread is to get paid for reporting the bug that finds out. The only problem was casino representative ignore his findings which is why he is asking advised here. The only problem was Owl.games is already out in the forum and focus only with their social media and customer support on handling things like this.

Nevertheless, People should not expect reward on finding bug. It’s up to the casino if they will reward you or not if they don’t have bug bounty program.

It's better if you make a comment to their thread here in the community and wait for their response if that bug doesn't have affection with the transaction and abuses the current system of their current platform I guess they will just ignore those but if you see that as critical might damage and make them lose a lot of money I guess that's the time they make an action. Better to contact their email or just the moderator in the chat if they have.

The best way is to engage their discussion thread here on the gambling section or contact their representative, also if the case involved is beyond an ordinary report then one can open a reputation thread against them and present your take, we cannot expect all the casinos or gambling organizations to function the same way we have with others and as for those not on the forum here, it may be difficult to get across to them since they know that they already had a vulnerability, they wouldn't respond to your complaints and this is part of the risk associated to using casinos we aren't sure about their reputation.

I think ops is not making a personal claim of harm from the casino and all he want to do is to report system vulnerability to the team, so creating thread has noting to do with this and I think ops did right to open this thread so that he can take suggestions and advise from other members here who may have experienced similar system loophole before.
The best option os that ops should continue to make a support tickets, and reporting the situation.

So I discovered a bug affecting a mode of play at OwlGames casinos that results in certain games rewarding more money than they should.  I tried to report it to OwlGames but was told that they have no bug bounty program and to "enjoy the bug" (not kidding).  (of course their docs say that any "exploit" can result in not being paid out, but it's not an exploit if it's simply how things run under the given conditions - not that that would stop them from screwing someone over I'm sure)

Their poor attitude certainly doesn't do much to make me want to help them out anymore although that was my intent. 

Fortunejack was one of casino which run bug bounty program in the past Bug Bounty on FortuneJack | Get Rewarded for Finding Bugs, but since owlgames doesn't run bug bounty program and they're not appreciating the @OP for finding the bugs, owlgames can't be blamed in this situation since it's in grey area.

Yeah maybe those users are exploit the bugs in order to get easy money, moreover if they're have a good understanding about privacy, they can escape from chainalysis. I just hope the @OP didn't mad and exploit the bugs, although he can do that.

Well this thread is very good, but before continuing to see suggestions, what casinos offer rewards or incentives to report these bugs? I don't know of any casino that says that any bug they suggest will be rewarded, because most players or those people who are in casinos and get vulnerabilities don't report them but exploit them, because that way they get a lot of money, and that's what they do.

The best way is to engage their discussion thread here on the gambling section or contact their representative, also if the case involved is beyond an ordinary report then one can open a reputation thread against them and present your take, we cannot expect all the casinos or gambling organizations to function the same way we have with others and as for those not on the forum here, it may be difficult to get across to them since they know that they already had a vulnerability, they wouldn't respond to your complaints and this is part of the risk associated to using casinos we aren't sure about their reputation.

So I discovered a bug affecting a mode of play at OwlGames casinos that results in certain games rewarding more money than they should.  I tried to report it to OwlGames but was told that they have no bug bounty program and to "enjoy the bug" (not kidding).  (of course their docs say that any "exploit" can result in not being paid out, but it's not an exploit if it's simply how things run under the given conditions - not that that would stop them from screwing someone over I'm sure)

Their poor attitude certainly doesn't do much to make me want to help them out anymore although that was my intent. 

But since it is only certain games, from 1 provider, should I try to contact that provider instead?  It's possible I imagine that it's not just OwlGames that might possibly lose money to the issue, though I really don't know.

I guess since these are casinos, losing a couple hundred to a few players every few days that would otherwise not have won anything maybe is just a drop in the bucket.  But I found it so strange that they immediately just alerted me that they have no bounty program.  Aren't casinos supposed to be pretty protective of their money even if they have a ton of it? 

Anyone else have any experiences of trying to report issues like this?  I want to be rewarded for my time verifying the issue without taking advantage of it and alerting someone about it, too, so I'm also just worried about giving the info out and having them come up with some excuse like "oh it just needed a restart it's fine now, that's not a bug."

As @uneng have mentioned in this topic, the thread was already locked by project manager which seems to me that they don't have actions yet or are just disregarding their players' concern. In this case, moving to another gambling platform would be a better idea than to wait for them to solve the issues; that is their responsibility in the first place and that is not something a player should still ask for them. Bugs and other 'glitches' are somewhat normal for new projects especially we are talking about online platform wherein servers are huge. But their action would speak louder than their words for sure.

The best way is to engage their discussion thread here on the gambling section or contact their representative, also if the case involved is beyond an ordinary report then one can open a reputation thread against them and present your take, we cannot expect all the casinos or gambling organizations to function the same way we have with others and as for those not on the forum here, it may be difficult to get across to them since they know that they already had a vulnerability, they wouldn't respond to your complaints and this is part of the risk associated to using casinos we aren't sure about their reputation.

It's the first time I've heard a casino say "take advantage of the bug".
maybe it's a "small" bug that can't have a big impact on their economy?

at this point it is certainly correct to talk to the provider of that specific game just to have a "clear conscience" and act honestly.
unfortunately there aren't many solutions in this case if they don't want to award the players and exploiting the bug I don't think is the correct solution (also because they may simply not pay you...)

Anyone else have any experiences of trying to report issues like this?  I want to be rewarded for my time verifying the issue without taking advantage of it and alerting someone about it, too, so I'm also just worried about giving the info out and having them come up with some excuse like "oh it just needed a restart it's fine now, that's not a bug."