Skip to content
unAuthX
PARTNER WITH THE LEAGUEPARTNER WITH USENTER THE LEAGUE

SECURITY POLICY · VERSION 1 · 2 OCTOBER 2026

FOUND A FLAW? TELL US FIRST.

Competitive hacking at unAuthX happens inside authorised, isolated Cyber Ranges. This website is not one of them. If you find a vulnerability in it, report it here, in good faith, and we will work with you.

IN SCOPE

  1. 01The pages of unauthx.com.
  2. 02The form backend at unauthx.com/api/.

OUT OF SCOPE

  1. 01Denial of service, load or stress testing, and anything that slows the site for others.
  2. 02Social engineering, phishing or physical attacks against our people, partners or providers.
  3. 03Systems run by our hosting, email and other providers. Report those to the provider.
  4. 04Reports from automated scanners with no demonstrated impact.
  5. 05Missing hardening settings with no demonstrated security impact.
  6. 06Any Cyber Range or Match. Those have their own rules.

THE RULES

  1. 01Use only your own form submissions. Never access, change or delete anyone else's data.
  2. 02If you reach someone else's data by accident, stop, keep no copy, and tell us.
  3. 03Go no further than you need to show the flaw.
  4. 04Keep request rates low. Never degrade the site for others.
  5. 05Give us 90 days to fix it before you tell anyone else, unless we agree a different date with you.
  6. 06We do not run a paid bug bounty. Do not ask for payment as a condition of telling us.

HOW TO REPORT

Email team@unauthx.com with SECURITY in the subject. Include the page or endpoint, the steps to reproduce it, the impact, and how to reach you. Leave personal data out unless it is needed to show the flaw.

The same contact is published in machine-readable form at unauthx.com/.well-known/security.txt.

WHAT WE PROMISE

  1. 01We acknowledge your report within 5 working days.
  2. 02We keep you informed while we fix it, and tell you when it is fixed.
  3. 03If you followed this policy in good faith, we will not take legal action against you or report you to the police for that research.
  4. 04With your permission, we credit you by name or handle once the fix is live.

WHAT THIS POLICY CANNOT DO

It covers only systems that are ours to authorise. It does not authorise research on anyone else's systems, including our providers'.

Nothing on this site authorises access to any other system, network or data. Access without the owner's permission can be an offence under the Information Technology Act, 2000 (sections 43 and 66).