Topic: How best to report vulnerabilities? (Read 659 times)

It is really just that right that he would be needing to approach up the team and its not always talking about compensation or bounty in related to this matter on which we are really that in concern about reporting some bugs or exploits but turns out the team or casino owner or team doesnt really care at all or they might be able to see that hole and had already fixed it out without telling op or something like that.
Its not always the case that we would be hearing out some response in regarding the situation on which people would be boggling up their minds if the team doesnt really care at all or just simply had
resolved and fixed up the problem.Its true that this is a crucial if we do speak about exploits and holes on a site where it is something that they could just ignore.

I still don't get why op is disturbing the casino team. Does he want to te us that the tell are not aware about the bug? Let me tell you having bug in the system is not always the problem, sometimes it is left that way to test the nature of the system in asmuchas it does not have any issue with the casino. The users interface is a very important thing that is mostly important and once that is done then other small small bugs should not be a problem.
 
If op continues to pressure the team about it, they may think he is trying to imform them so that he might ask for compensation at the later end.

Yeah, you're right. It seems pointless to keep discussing this if the original poster isn't around anymore. I'll never understand folks like that.

I reported this thread as well. It's up to the mods now.

Yeah so with multiple reports to moderators to lock the thread, within the short time, the thread should have been locked by the moderators.
The thread has generated enough discussion and suggestions that are not only helpful to ops, but to the rest of us, we have all learned something from the responses of others here on this thread

Good observation and suggestion as well, I just checked now and discovered the same, it makes no sense to keep discussing and pouring out suggestions here whereas the person who the suggestions and advices are directed to isn't even here to see them..
Or to even give an update on the later outcome of his discussion with owl.games team.

I will also support that this topic be locked, since the op is not here, I suggest the mods in charge of this board to please lock this topic.

Is it still should be continued the discussion where the OP created his account on January 20 and last active on 21 January? I don't think he will come again to check the discussion that we have described here.

So It should be stopped I think and it's already enough what we have made.

It is for these same situations that I strongly insist that casinos should have a special section where they tell their potential players that they are able to see beyond what some were said to do that they can make vulnerability reports so that they can be rewarded. , some say that if the flaw is minimal there is no need to report it, but any vulnerability is important, because that player can resort to an exporter who through that vulnerability can have access to an entire database system and steal everything including the funds of players.

You definitely did the right thing by contacting the casino discreetly but their answer puzzles me too. Perhaps they thought you were not being serious or that you were trying to dupe them into paying you money or something? I cannot imagine any casino willingly losing profits. Or even worse, not caring about the stability and security of the casino website itself...

It definitely is a strange thing.

Unprofessionality of the casino aside, if they gave you the green light to exploit the bug then I guess you should take their advice and squeeze as much money out of them as you want. And they have no right to complain later, since they told you to go ahead.

For these cases, my main objective is to reach the casino's management. But the first challenge here is the support. If you told it to a close-minded support agent, most of the time you will get a response just like what you had. They will not understand your concern and will give you some guff sentences, sometimes they even use their canned messages in the wrong way.
So if you are really into it, try messaging them again at a different time, hope you got another support agent which has an open mind when it comes to these cases.

It was normal for him to think of getting paid for reporting a vulnerability to customer service, but not all casinos will reward people who find it. So we don't have to hope too much to get it. But I also think they could just block your account, as @nakamura12 said because they think we have exploited the vulnerability for our benefit. So it will be up to each person what they will do if they notice a vulnerability in a casino site, and hopefully, after we report it, the casino will reward us.

As far as I know, for this you gotta have knowledge of programming languages so that you can report the vulnerability along with its solution/how to fix it.

I think they already knew about it that's why they didn't taken you seriously.
However, they should have given some reward for your encouragement so that you can report any vulnerabilities to the casino in the future as well.

Why should he go through all of this when he has an answer from the support?

Think about it for a moment. You see someone lost a wallet, you approach him and say hey, your wallet is on the ground, and he says, I don't care, what do you do? You Go there pick it up and approach him again? You call other people to the spot to show them the wallet?
Seriously, I'd just walk away. If the owner doesn't care, I did my job and I think OP did his job 2 times already, first by reporting it to the support and second time by starting this thread. There's no point to go to Owl's thread and once again report the bug they don't show any interest in fixing.

That's the problem if you got got the right person from the team because if you don't then there's a possibility that the person you contacted might have used the bug and if you also did take advantage of the bug and that person found out about it then you will be most likely getting banned for that reason. It is also what comes to my mind when reporting vulnerabilities which is getting paid more like a bug hunter if you ask me.

The first thought that comes to mind about reporting vulnerabilities is "getting paid for it"  It is easy to report a vulnerability, just ask the desktop service of the site how to do it and where would you email be directed. Do not just send a report to any email, as sometimes employees use vulnerabilities, just make sure it reaches the right person in the team.

If complaints about bugs to the development team are not responded to properly and are just ignored, it would be better to be silent and let them feel the loss and problems from the occurrence of bugs in one of the games.
After all, with this bug, I'm sure many gamblers take advantage of it to generate quite a large amount of profit.
However, things like that are actually not the fault of gamblers who use them, but the fault of the development team who are careless and don't want to know about submitting reports of bugs.

That is it, since op has made several attempts to get the attention of the team to work on the vulnerability and they refused to listen or reply him the best op can do is just to look away and not take part in those games with bugs since even if he doesn't exploit the bug to abuse the casino others will exploit the chance and ruin things for everybody who may have to take part in that particular bug games.
So to avoid getting cut up in general punishment, ops should keep reporting the bug to support and also avoid playing the game the bug if detected.

I suppose most casinos somewhere on their TOS have a clause which allows them to void any profits the player may have gotten if they were exploiting a bug, so I doubt this is something advisable to do as you will risk your account getting banned by doing this.

I still think there is not much for the OP to do as if the developers of the casino do not even want to listen to a bug report, the OP should simply move on and let them to suffer the consequences of their carelessness.

Well, I personally see no sense in using a delay tactics for the player since he has contacted them and was willing to report the bug to them, I believe that if he wanted to expose the bug or maybe exploit them through it, he wouldn't have bothered contacting the owl team at all.
Personally, I think the way the owl team behaved or responded to the issue is clearly unprofessional, a good company should listen to every enquiries, suggestions, reports at all time, it is not up to them to decide which is a good information they can keep and work with, and which is bad or unneeded information they can discard.

Exposing the bug or vulnerabilities isnt really an ethical thing for you to do so for someone who do able to point out some holes on a business like this which we do know that it is really indeed that crucial.It isnt really just that too professional for them on handling it out because they arent really responding actively and trying out to resolve out those issues which it can potentially harm out the business and might end
up on having those huge withdrawals if ever OP and other people who discover would able to abuse it on their own.We dont know if op had already got some response on the team but it turns out that you had
made out some complaints or reach out too but didnt still get a reply which is really that mind boggling if you do ask me.These businesses wont really be tending to miss out these kind of
things.

There's nothing you can do mate since they didn't think that you are serious about the bug that you found. Since they explained it to you that they don't have bug bounty running up. Well, it's up to you either to take advantage of the bug and won more money than it should have and good luck about not getting found out that you exploited a bug. Maybe try to make some copy or an evidence that they told you to enjoy the bug. I can also think that it could be an event of some sort if you ask me but who knows what it really is what is the situation.

If ops have tried to reach out to tge casino involved via their support and there is no positive response, i think ops should contack tgem again, may be busy or there have not find their way around the situation so their team are just using the delayed tactic for the players so that he will not expose the venerabilities.

I see a failure there, because we have witnessed that when there is a failure in a casino, those who discover it do not report it, but instead explode and often cause that casino to suffer losses and even go bankrupt, especially casinos that are started, if only there was a part where the casinos tell them that if they find a bug, they could reward it according to the degree of complexity, as they have established here in the forum, that if they find a bug they pay in gold terms, and that is something that motivates a lot, if there is no monetary motivation, it is very difficult for them to achieve things.

Nope. You will just make the casino exposed to multiple abuse once the bug is critical to their security. Reporting a bug should be in private through customer support or the official email to make it discreet to other players. I believe the OP main goal for creating this thread is to get paid for reporting the bug that finds out. The only problem was casino representative ignore his findings which is why he is asking advised here. The only problem was Owl.games is already out in the forum and focus only with their social media and customer support on handling things like this.

Nevertheless, People should not expect reward on finding bug. It’s up to the casino if they will reward you or not if they don’t have bug bounty program.

It's better if you make a comment to their thread here in the community and wait for their response if that bug doesn't have affection with the transaction and abuses the current system of their current platform I guess they will just ignore those but if you see that as critical might damage and make them lose a lot of money I guess that's the time they make an action. Better to contact their email or just the moderator in the chat if they have.

Wait what are you suggesting here? OP is just disappointed to what is the response of the team towards His report on Bug in their site(maybe disappointed as he did not received a single penny for his report) but this does not even connected to bad reputation..
hope that you read the whole post and understand before replying.

but it looks like continuing to create support tickets to the dev team will only make it more complicated. because at first the OP was ignored by the team and if you keep making support tickets, it's like the team requires you to accept the report and the team can judge that OP only wants to make a profit, that's not good for me.
and it would be better to still provide personal contact information that can be contacted so that one time the team has the wrong idea they can contact the OP to continue the bug report.

That is not a good attitude addressing the person concern about their business and operation , but if you are hurt because of not getting any bounty then that is their way so sorry for not having yet they are not giving any amount.
But maybe they have just react that way but deep inside they are finding that bug for their own safeties it is just they don't want to give you hints how helpful that reporting you did for them.

While OWLgames is one stablished gambling site and running their own token as well, this seems to be a insult having bug still with long experience and activities here.
but compensating the reporter would not hurt them so why need to be that acting? maybe this will let others who found bug on their site to deny letting them know and maybe will be used to attack them though i don't pay consent in this act.

Fortunejack was one of casino which run bug bounty program in the past Bug Bounty on FortuneJack | Get Rewarded for Finding Bugs, but since owlgames doesn't run bug bounty program and they're not appreciating the @OP for finding the bugs, owlgames can't be blamed in this situation since it's in grey area.

Yeah maybe those users are exploit the bugs in order to get easy money, moreover if they're have a good understanding about privacy, they can escape from chainalysis. I just hope the @OP didn't mad and exploit the bugs, although he can do that.

I think ops is not making a personal claim of harm from the casino and all he want to do is to report system vulnerability to the team, so creating thread has noting to do with this and I think ops did right to open this thread so that he can take suggestions and advise from other members here who may have experienced similar system loophole before.
The best option os that ops should continue to make a support tickets, and reporting the situation.

I doubt any legit casino would say something like "enjoy the bug" or have no bug bounty program. Or maybe it's  a whole different story. They are aware of the bug, but they don't do anything about it. Only when someone exploits the bug, they confiscate their funds saying that they abused a bug in their casino. As long as someone is losing, they wouldn't care. If someone is winning, they can put an excuse saying that the bets are invalid due to slot malfunction (all slots literally have this rules were your bets are invalid if the slot has issues) and deny them their winnings.

Since support wasn't helpful, try contacting them here if they have an ANN thread. If nothing, I would advise you not to exploit the bug since they will end up confiscating your funds.

if the site rep/admin or any other staff from the casino ignores the situation, better move on as they are not interested to address the given problem. or better yet, they don't want to give reward to the person who found the bug, and they will just address it silently. but if the bug is still there, better play on another site which you think is taking care of its customers.

As @uneng have mentioned in this topic, the thread was already locked by project manager which seems to me that they don't have actions yet or are just disregarding their players' concern. In this case, moving to another gambling platform would be a better idea than to wait for them to solve the issues; that is their responsibility in the first place and that is not something a player should still ask for them. Bugs and other 'glitches' are somewhat normal for new projects especially we are talking about online platform wherein servers are huge. But their action would speak louder than their words for sure.

The best way is to engage their discussion thread here on the gambling section or contact their representative, also if the case involved is beyond an ordinary report then one can open a reputation thread against them and present your take, we cannot expect all the casinos or gambling organizations to function the same way we have with others and as for those not on the forum here, it may be difficult to get across to them since they know that they already had a vulnerability, they wouldn't respond to your complaints and this is part of the risk associated to using casinos we aren't sure about their reputation.

Well this thread is very good, but before continuing to see suggestions, what casinos offer rewards or incentives to report these bugs? I don't know of any casino that says that any bug they suggest will be rewarded, because most players or those people who are in casinos and get vulnerabilities don't report them but exploit them, because that way they get a lot of money, and that's what they do. You have to change the casinos, so they protect themselves twice so that they are reported and so that they no longer have this type of problem, in everything that is online there will always be vulnerabilities, but if they do not offer good rewards it will not be attractive to some.

I think you should change the title of the thread that will call out Owlgame, so they come here and explain their side of the story, we don't know the real story until we hear their version but what you've posted is not good for the reputation of a casino, they just ended their signature campaign and they have one complaint that is still unresolved.
It's irresponsible especially for a casino not to fix the bug or even not acknowledge it because it will end up a more serious issue, no gamblers will want to play in a casino with bugs, as the true result will not reflect on their game.

Amazingly, your account was made for your post. So if interested, stick around the forum and learn more about different stuff, not just gambling but crypto in general.

Anyway, you have already done your part in reporting and contacting them. If they still didn't make a move on it, it's their loss. Good job on finding it! Can you share how you found out about it?

This is really strange and  you should possibly recheck it again if you haven't done so because since you've already informed them, I'm sure they might have gone to check it out without wanting it seem like a big from them or wanting you seek for a compensation from them but in the other hand their response was really strange to me and I must confess that if I was to be in your shoes, I would take a greater advantage of what was presented to me without hesitation but I'm sure that if they were in the position to take such advantage of me, they would do so even without having to inform me on ay issue or so.
But at same time I think th casino doesn't haven anything or much to loss since the casino might be provably fair but what this bug might so is just give you some winning advantage over other players.

Well, not all "bugs" lead to losses for the casino or the provider... some losses will give an unfair advantage for players who knows how to "game" the system ....and this gives them a higher chance to win over other players. I explained in a previous post how players of Mount Magma figured out how to win the daily jackpot.... so the casino did not lose anything, because the daily jackpot payout in any way.

The thing is...... if you say your games are provably fair, then you have to make sure that everyone gambling at the casino... have the same chance to win on all the games. 

Don't expect about them giving bounty to you for discovering a bug if they give then much better if not still fine but at least you help them figure out about the issue and as well you help other gamblers to make their playing experience became more convenient to them.

But if you think the bug is severe and it takes a lot of time for you to discover this then try to contact them and ask about possible reward maybe they can think about it.

I agree with this. At least we have tried to help them and pointed out a bug in their casino and hope they can fix it so that people do not abuse it. If the casino gives us a bounty, that's a good thing because it means they really appreciate our input and can fix bugs immediately too. But usually, if it's a big casino, they will give a reward to the person who found the bug to show gratitude.

Dude, you created this forum user "owlbugreporter" with the only purpose of opening this thread? Just wow. Anyway, if you have reported this bug and their support said you're free to exploit it, so where is the issue? Just do what they said, that's not your problem anymore. It's a bit weird that they're letting you win more than you would normally without the bug. Perhaps they thought you're one of those scammers demanding bounty for fake exploit reports.

well Bug reporting does not mean we must be rewarded but for the team/casino side? giving at least generosity for people trying to help them out is better instead of just ignoring those people effort .
Bug is really something that must be addressed and even some big site are asking for bug bounty just to help them out.

I think that you are correct in this point you made but the problem is that I could not understand that the grammatical expression of your ear use of how much so please the next time I think you have to break it down for me to understand exactly what you mean at the last part of your sentence I am confused of the statement being casino provide a bug a bounty.

I am thinking that what if they truly take it seriously but they only reply like that (in a joking manner/tone) only to make it not obvious that they truly care because maybe they don't want to pay anything for that user who reported the bug.

They say enjoy the bug and then by the time the guy try it out again, he will only be shocked that the bug doesn't work anymore but I think he won't get angry because that was also what he wanted to happen. He is too kind. I hope others will be like him. If only all gamblers are like this then I don't think the casino will be tough in terms of their requirements because they know that none of the gamblers will abuse it.

Op should not bother himself on the issues since the casinos had clearly stated that they do not have any bug bounty current so op should not feel like he want to show them what they are already aware of.
This might just be something they are aware of and they allow it to keep going because it won't have so much effect on there finance.

While people out there exploit casino vulnerabilities to their own advantage, Op is here to help keep this bug from leaking into the wrong hands. Instead of giving gifts but reciprocity which is not so good Op accept. Although vulnerability is one of the weaknesses of casinos, they should be grateful to whistleblowers and rewarded. So far, Op may need to enjoy the benefits that have been obtained, and as long as the casino doesn't give a positive response, the solution is to try to drain it. lol

It's the first time I've heard a casino say "take advantage of the bug".
maybe it's a "small" bug that can't have a big impact on their economy?

at this point it is certainly correct to talk to the provider of that specific game just to have a "clear conscience" and act honestly.
unfortunately there aren't many solutions in this case if they don't want to award the players and exploiting the bug I don't think is the correct solution (also because they may simply not pay you...)

You are probably one of the first people that a casino has turned around to and said "yes, enjoy the free winnings from a hole in our games!". Enjoy it! Win, withdraw, win, withdraw, until you can't no more. You do have their permission at the end of the day! I certainly wouldn't pass up the opportunity 

To answer your question though, the best way to report it is to record the anomaly and detail how exactly to replicate it. Then send it to the team, or as you said, to the game provider. Whichever is most applicable.

Either way that's a bad attitude they should at least acknowledge the report, even if they are not giving rewards at least they should be considerate enough to acknowledge, with that kind of answer they don't care because coming from their own mouth if this is true they will just not honor coming from bugs, the gambler is the one that will suffer because he thought his winning comes in playing fair, it turned out there is a bug, I want to see Owlgame answer into this allegation this is serious and gamblers will opted not to play in their platform.

I am thinking that they don't want to acknowledge but they are doing in the background to address the issue.
Yes, the OP can check if the bug is still not fix, either their team is not addressing it or they don't know how to address it.
If you have done your job of informing them and they just shrugged it off, it means, they should not blame anyone if another user found the bug and exploited it.
I believe, not all gambling sites have that kind of reaction towards a user who is reporting a bug, some will entertain your report and may possibly give you a reward or bonus though.

If that's their response towards you, then they aren't open for feedback and are slacking off their jobs to maintain the casino abuse-free which is really a cause of concern since these abusive activities are prohibited in the first place. Why would they even say a statement of enjoying the bug, if really there is any instead of acknowledging their shortcomings and giving a reward? Perhaps they are just too complacent and too confident that it won't happen, or they just don't want to acknowledge your report because they have to give a reward, which they don't want to.

Check whether the casino still have this bug and if they do, they probably are just confident and slacking off maintaining the casino away from glitches. If it suddenly don't have it after you reported, then most probably they have taken an action about your concern but decided not to credit you for noticing which I believe is such a jerk move if ever it is the latter reason.

 
Include the screenshot of the conversation if you still have it or you can retrieve it, they might accuse you of just making up a story.
 
They have an obligation to report a bug or entertain people that find a bug because this is a trap, in the end, Owlgame will ban people for exploiting a bug, and some players unknowingly play the game and win money, and because of the bug they cannot cashout what they've won and get a ban instead.
Owlgame should address this issue as it puts its reputation at risk.

It's normal that @OP doesn't want to say the name of the game and which casino it's from because he doesn't seem to want people to know about it and then have them report it to the casino so those people will get the bounty for finding the bug. And if the @OP decides not to report it to the casino and instead uses the bug to its own advantage, the casino will find out sooner or later because the casino can see who has a winning streak or can win a lot. And if the casino suspects it, the casino can investigate it and if it finds that @OP has cheated, the casino will freeze his account and not allow @OP to play again. This will prevent @OP from being able to gamble at that casino again, even though he can still gamble at other casinos.

I think ops will not want to mention the name since he is trying every possible efforts to get the game provider attention to fix the bug, I don't know why a casino should take such a report with laxity.
What if ops decide to keep it to himself and continue to exploit the loophole and take advantage of the bug to exploit and abuse the casino system?
That could lead to more severe outcomes for both casino and the player and possibly the player could walk away knowing already what is involved in exploiting such loopholes.

Without saying which game it is and which provider it belongs to, could you explain what kind of loophole or bug it is precisely and how it works exactly? Are you sure you're not just encountering a long winning streak on this game. Because one time I got many wining rounds in a row, and I really though the game was bugged but unfortunately it didn't continue like that for long and I lose almost all the winnings I made at the end. 

You just did it responsibly when you've seen the bug. But maybe it was way of your approach or explanation so that's how they reacted. Thus, it's on their end that's not really interested on knowing that bug. I can think of any other reasons.

As they say, they've got no bounty for that and just made it look like that they're not interested on it but on the other hand, they've already taken note of the reported bug of yours and have it fixed already.

Did you check if it's already been fixed? If so, then the latter part is correct.

I found a bug in a game called, "Mount Magma" a while ago .... and I also had the same problem. The bug was in the Jackpot system and it caused unfair wins to people who managed to pick up on the exploit.

It was quite simple.... if you bet high amounts close to the time when the Jackpot paid every day.... you basically won the Jackpot every time. (The more you win.. the higher you could bet.. and other people could not match your bets) 

https://clashofslots.com/slots/pushgaming/mount-magmas/ 

I reported it on this forum and someone saw this and they pulled the game for months until they brought it back many months after that... with the Jackpot feature disabled. 

Even if they haven`t the bounty system, the OP ought to fix bug and the answer of the support. Such moments always must be fixed, because we often see that the support tell us one thing and after that tell us the other. If we fix all such moments nobody can ban for "bag using" if the support said that it is ok and you can use it.

There are only a few people that won't be exploiting the bugs like you and didn't take advantage of them, but for sure, if others see this, they will take that opportunity to get more money. I'm hoping you were the only one who was aware of it. Even if they don't have any rewards, bug bounty hunters will usually send an email to the support team with information and screenshots about the bug. As you have already informed them and have received not good feedback from their support, try emailing those to them. I think they need hard proof before they will act on this.

If there's no bug bounty campaign, then you can't expect the site to reward you but if you're talking with the good site probably they'll appreciate your effort and will give you some free draws. The site will surely notice that later on, and those who abuse that bug might face a big problem later on. Just tell the site about it if you really want to help that site, if not then no one is forcing you to do this. Bug on a site is quiet normal for a new site, usually they run a lot of test to see that bug until they become a better site.

I know right. Even I remember once when I found one or two issues on a site which didn't have any bug bounty program.
I tried contacting the support but never received any response. I guess in these situations it's best to leave the bug just like that.
Now that money is involved here may be you can try posting it on their social media handles but even then if they don't care to fix the bug then just leave it as it is.
You have already done your job of informing them.

Yeah bugs can be easily removed through live chat when choosing a live chat, you need to consider the variety of games available and which software providers are powering the live chat casino. Unfortunately, not all online casinos have a large live chat game range yet online casinos offer reliable and high quality video streaming live games with an excellent selection of live games, among other game types extreme live gaming.

If I find a bug, I will notify live chat so they can immediately fix it and not be abused by other people who might see the bug to take advantage of the casino. Even though the casino doesn't give prizes to people who find the bug, I don't think about it because it's a casino where I play, and I don't want to see it getting abused by other members. But this depends on each person because some try to take advantage of the bug for their own benefit without telling the casino, and after they get it, they tell the casino.

That is certainly a weird reaction from the staff of Owlgames... does not sound completely professional.  

About bug reporting, I have never encountered a bug or exploit myself. I would certainly report it to the costumer support and hopefully receive some award, even if there was no bug disclosing program, I would do it, that way other people would not go through the bad experience of getting their accounts temporally blocked or their balances changed, after the casino eventually finds the error.

I would have advised the same but @OP might get a conflict and maybe resulted in a banned account since the casino had know that @OP know a bug, exploiting it will make him breach any contracts and will cause account termination.


that is good advice, that will definitely put them on their toe if they saw proof of the bug.  but of course don't get your hopes high on getting a reward, as they stated, they don't have any bug bounty so it might be considered voluntary work. 

No company would definitely taking those bug or exploit reports lightly because that would really be resulting into huge damage or loss if it would really be just ignored because someone could really be able to abuse it out and would really be making some huge effect in terms of revenue of the said platform.I do see the same reason that he might be able to reach out a staff on support who doesnt really just want
to bare up with those issues and just reject it out which we know that this is really that something crucial which needs to be resolved and not something to be rejected.
It is really that impossible if you do ask me.

I think OwlGames should do better job screening their employees. You have been talking to some low paid intern that has no skin in the game what so ever, someone who would do absolute minimum when it comes to their responsibility. Because no casino or site dealing with that much money would take potential exploits lightly.

You have done more then enough for them but if the development team hears about this the person you talked with surely gets fired. If they shrug their shoulders i would avoid OwlGames. But i think they would take this seriously if the word got trough.

^Sometimes there are gambling casinos that don't have a bug bounty but most commonly, there is a bug bounty campaign here sometimes and I think that is the right decision because it is either them or the gamblers who will suffer if there is a bug. Just report it and you are done, if you don't want to exploit it to others, just report it and don't exp[etc nothing because they barely give a value to their bug. Probably they will take action without knowing you because they are already aware. However, probably also you were wrong or they already are but they don't take an action.

That maybe because Owlgames is much smaller than them so Owlgames has a lesser budget and choose to not offer a kind of program like this but for a much bigger casino they already have the budget and this matter is important for them because again they are big already.

Even a tiny bug or glitch might affect the satisfaction of their customer and they can lose them. Or it could be that Owlgames is only confident about their platform and they think it was bug free? They even have that "enjoy the bug" reply. If I am the one who got a reply like that then I will take that as a challenge to try and empty their money. Let see if who will cry later on.

wow, what a shitty support team they have. would you mind posting a screenshot of it?

try contacting the game provider where the supposed bug is happening and then ask them whether they have a bug bounty program, and if they don't, ask them whether they could pay you for discovering a bug in their game and if they don't want to pay you then it is up to you whether you'd tell them what the bug is or not.

Probably the support team were not active at the time of the report. The OP has done is best of seeing the leakage (bug) and further to inform the casino support team but it was not responded back to him to know whether the bug has been fixed. Op I know their signature campaign and ANN threads are dyfunctional but you can still contact the through pm to inform them about the bug. Because that is a very big situation to be solved before it is too late. But if the casino in question muted your information then they are aware and know what they are doing.

If you're talking about playing dark mystic (Groove)
Don't waste your time, it only works in demo mode

If you are really that having that kind of thinking that you are tending them to help then you should tell them right away whether you would be paid up for some bounty rewards or not but since you are afraid that you might be hearing off those common reason that it wasnt a bug kind of word line then it do pertains that you are really expecting some reward.If they dont really take it seriously into those words of yours on seeing
some exploit or bug then better to make use of it and that would surely caught up their attention.If you do tend to help then you wont really be worrying whether they would be holding your funds or not
as long you are really that minding about protecting them and giving  that fair way or winning.

I think it's likely that you weren't very convincing in telling their team about the bugs you found. I mean, did you when telling their team a few bits to further convince their team to consider it all?
bugs that occur in casino games must be taken seriously and it is very impossible for the team to ignore this and the team should take this bug seriously.
I appreciate your work but if indeed their team really ignores you, you also have the right to look for bugs elsewhere to help other casinos who can appreciate you.

I was paid remuneration only by a few projects, they are on bitcointalk. When I tried to contact the provider, half of them just ignore me.

I was about to point ops in that direction also, the bug should be reported to support ASAP and if supported with the necessary evidence in a pictural manner it will help the support agent to accept and processe your request.  The casino team may have reacted that way because of the fact that at the moment the team is not paying anyone for bug discovery bit in other to protect everyone from this mess, you should continue your contact with them and provide evidence as mentioned,

I'll commend you OP what you've done is a very good thing for the casino cause what like other said some gamblers who encounter any bug of the casino then they will still silence ,  and use as a advantage to win in thier bet but what IP did is that he report it and contact The facilitator of the casino to take an action immediately before the big use in abuse and the casino will lose a lot of money.

I think that they will just fix the bug without any payouts. Or it would be an opportunity to ban winners for bug using. If the OP told what the bug he had find the best way is to fix dialog with support screenshot to have some proves if they fix it. Anyway you can`t get some bounty here, and i even can`t say that casino is cheating if they will fix bug. But it can`t increase my interest to this casino.

You already reported the matter to the platform. If they didn't receive it well, then it's not your problem anymore. It's up to you if you want to notify the game providers about the certain bug. Most probably they won't reward you, but at least you will receive some kind of gratitude to them through words. It's just funny how the gambling platform, which has a lot of stake in this matter than you do, treats this matter as if it's a non-issue. Well, they can always remove the game on their list of games so maybe that's why they responded that way.

Well if the bug isn't that serious, they will fix it the moment you mention it. That means you don't really deserve a reward for your discovery.

If the bug is a complex one, you need to find a way to describe the problem without giving them the important hints.

Maybe you warn them first and if they aren't interested in your proposal just use the exploit and give them a taste.

They will be all ears then.

I've known owlsgames to be one of the reputable gambling casinos on this forum and getting this brought in place as observed is another big concern, when we are talking about bugs I don't like anything to do with such casino found with that, but in this case since this is coming in from the first time let's not assume to the suspected situation and if be, there's this possibility that they were not aware of it and if they do i want to be rest assured they are also working on it because it will paint them black and red is they got nothing to defend themselves from it.

You can immediately report it to the casino if you find a bug in the casino. Regardless of whether there is a bounty for those who can find the bug or not, you don't need to think about it because what you are doing has helped the casino so that no one is cheating.

But the casino should provide a bonus for those who can find a bug as a sign of gratitude for the casino for that person for notifying a gap that can be abused.

And it's going back to the casinos because we just want to help them by finding those bugs. There are still many casinos that can appreciate the help of others and the casino can give gifts to people who find them.

I am tempted to tell you to make some money for your self since they care less about it, maybe doing this would indeed bring their attention to it, and maybe they would realize how severe the issue is..

But based on what i said above, and since they don't seem  to understand the gravity of what you are pointing out to them, i would advice that you exploit them through the bug, but don't spend the money, send the money gotten from the exploit back to them and ask them to reward you accordingly..
What i sense with them is that, they probably think you are one of those trolls looking for how to extort money from them, exploiting them through the bug(like i said before) will bring their attention to how severe the issue is and they will give you the attention you deserve.

You already have good intentions by informing the casino management team that there is a bug in the OwlGames casino. If the management team doesn't respond to you properly and instead they dispute your report, it's better for you to remain silent and let them work on their own rather than end up being disappointed yourself. for not being given a good response.
Very few gamblers care about this and instead they use it to play games that are experiencing bugs in order to win large amounts.
That's why I applaud what you have done because indirectly you want to help casinos that have a bug problem in one of the games in it.

That is some very bizarre behaviour from the casino and if they are encouraging you to use the bug then you can effectively create your own reward. The sad part is someone could be actively exploiting this right now and draining away active player funds if it is profitable like you suggest. It's not normal and most casinos would jump at the chance to plug any gaps for all sorts of reasons. Definitely a good idea to stay away as a player if it's true.

The way I view the OP statement was he reported that there is a bug in the game to the support but he didn't explain the full details after the support tell him that there's no bug bounty program to reward him. I guess the bug is still not fixed since OP will not gonna think to report it on the game provider if he already told it to Owl and they just didn't take action on it. I mean he can simply abused it if Owl knew the existence of the bug and didn't solve it.

I don't know about owlgames casino,I know about the bigger ones sure they may not offer a bug bounty to people finding bugs but they take such claims very seriously and pass the matter to their technical team to verify such claims.

If provided video evidence which for me would be the best,things can be taken more seriously from the casino mentioned here,they probably should take such claims much more seriously and their technical team should be upgraded as a minimum if it happens that the bug is true.I find that answer "enjoy the bug" really worrying about their behavior.

Well, the most important thing you did and reported a vulnerability that allows dishonest players to take advantage, I think Owl.games will contact this provider, well, or you can try to inform them too. In general, the well-known bug bounty program conducted such online casinos as Fortune Jack, Betcoin, Bitcasino, CakeBet, you can look at the current reward programs in the Public bug bounty program list https://www.bugcrowd.com/bug-bounty-list/

if there really is a bug in their game of course this should be a serious concern for them, but if indeed they feel it's not a bug I think you also need to provide complete evidence to give them confidence not just a screenshot or you can use it with another way to let them know, to my knowledge there aren't many casinos that provide bug bounties

This is what I think as well, I mean the OP found a bug and instead of keeping quiet about it and taking advantage of it they decided to alert the casino about the possible consequences of this bug for them.

But for some reason it seems the casino disregarded their report and at least for now it does not seem as if they will do anything to try to correct it, in my opinion the OP has already done enough and should not feel responsible at all if another gambler finds out the bug, takes advantage of it and the casino loses a huge amount of money as a result for their negligence.

Giving it to support should be fine. Anything else that happens outside of that, whether they take note of not shouldn't be your responsibility nor should you even mind it in the first place imo. Now if it was a bug bounty program then that's a different thing, but it isn't anyway.
I reckon it's to clarify things? I mean it's better to sooner tell someone that they don't have bounties for it than let them do it for nothing, could be a drop in rep if known after all. As for bug bounties, Casinos would probably tell their users, or at least have an ANN sort in their local forums (if it has one) or public social media if they ever have one. And as I've said before, anything after than that, whether they fix it, or "think" that they fixed it, or leave it alone, it's not your problem anymore.

I'm not a bug hunter but I think when you contact the support and want to explain the bug to them, it's better if you explain the possible losses if you taking advantage using the bug you found. I'm sure they will worried and want to fix it, so they will give you reward after you explain it and give a way to fix it.

It's shame how the casino didn't have bug bounty and didn't want to give small reward at least, although it's up to the casino since there's no agreement in this case.

Will you delete your paid signature and consider to wear any unpaid signature or charity signature campaign? it's really good to support humanity

You did your task mate. You didn’t exploit the bug, you reported it to the support team, so consider your work is done. If still now owlgames’s money gets drained out from their site, then they will be the only ones who will be responsible for this. Their immature behaviour and attitudes to such reports will surely land them into some trouble. I am really impressed by you OP that in this cruel world, where people are ready to do anything for making money, you thought about the site. Yes contacting the game service provider will be the ideal decision now.

Lol, that is so strange. I would tell you to post on their official ANN thread on this forum section, but it's just not possible, since it was locked on January 05, 2023 by the casino's moderator, as you can see below:

https://bitcointalksearch.org/topic/m.61549366

Their instruction is to make contact through the "24x7 support", but since you have already done that and was trolled by their reply, I really have no clue what else could be done. Did you try contacting the third party provider?

It seems they have been having issues with support anyway, since they locked the thread saying to be "re-arranging its strategies to offer the best support".

So I discovered a bug affecting a mode of play at OwlGames casinos that results in certain games rewarding more money than they should.  I tried to report it to OwlGames but was told that they have no bug bounty program and to "enjoy the bug" (not kidding).  (of course their docs say that any "exploit" can result in not being paid out, but it's not an exploit if it's simply how things run under the given conditions - not that that would stop them from screwing someone over I'm sure)

Their poor attitude certainly doesn't do much to make me want to help them out anymore although that was my intent. 

But since it is only certain games, from 1 provider, should I try to contact that provider instead?  It's possible I imagine that it's not just OwlGames that might possibly lose money to the issue, though I really don't know.

I guess since these are casinos, losing a couple hundred to a few players every few days that would otherwise not have won anything maybe is just a drop in the bucket.  But I found it so strange that they immediately just alerted me that they have no bounty program.  Aren't casinos supposed to be pretty protective of their money even if they have a ton of it? 

Anyone else have any experiences of trying to report issues like this?  I want to be rewarded for my time verifying the issue without taking advantage of it and alerting someone about it, too, so I'm also just worried about giving the info out and having them come up with some excuse like "oh it just needed a restart it's fine now, that's not a bug."