Security
LAST UPDATED: [INSERT DATE BEFORE PRODUCTION DEPLOYMENT]
Project Research LLC welcomes responsible reports of potential security vulnerabilities in Shuffle21. We take security seriously, even for a static, entertainment-only card-game website with no accounts and no real-money functionality.
Reporting a Vulnerability
If you believe you have found a security vulnerability affecting this Site, please email us at admin@projectresearchllc.com with:
- A clear description of the issue
- Steps to reproduce it
- Any relevant screenshots, logs, or proof-of-concept details
- The impact you believe the issue could have
Responsible Disclosure Guidelines
Please act in good faith when testing for or reporting vulnerabilities:
- Do not access, modify, or delete data that does not belong to you.
- Do not attempt to disrupt or degrade the availability of the Site for other users.
- Do not perform testing that could impact other visitors, such as denial-of-service testing.
- Give us a reasonable opportunity to investigate and address a report before disclosing it publicly.
Scope
This Site is a client-side, static web application. There are no user accounts, no payment systems, and no real-money transactions of any kind, which meaningfully limits the sensitivity of data handled by the Site. Reports related to client-side game logic, cross-site scripting, dependency vulnerabilities, and misconfigurations of the Site's own hosting are all welcome.
No Bug Bounty Program
Project Research LLC does not currently offer a paid bug bounty program or monetary rewards for vulnerability reports. We appreciate responsible reports and will acknowledge valid submissions.
Machine-Readable Contact
A machine-readable security contact file following RFC 9116 is published at /.well-known/security.txt.