ATG Public Bug Bounty Program

⚠️ Rate limiting ⚠️

Remember to rate limit your test tools to max 10 requests per second.

About

ATG (AB Trav och Galopp) is the gaming company that knows horse racing. The company was founded in 1974 with the mission to safeguard the long-term development of trotting and thoroughbred racing by offering responsible gambling. ATG has provided quality excitement and entertainment to the Swedish people since the first bet was placed. The company intends to continue doing so. Our vision is to deliver the world’s best gaming experiences. Our offering is: exciting gaming experiences in a fair, convenient and secure manner.

We are committed to work with security experts, such as yourself from all over the world to stay up to date and safeguard our customers, partners and employees. If you discovery a vulnerability that we should know about, do not hesitate and let us know.

We share your passion for security and appreciate your work!

Our rules

• We will respond as quickly as possible and keep you updated throughout the process
• We will not take legal actions against you if you follow the rules and scopes
• We will be fair and evaluate submissions according to realistic scenarios
• We reserve the right to cancel this Bug Bounty Program or change its scope at any time
• The decision to pay a reward is at our discretion

Your rules

We appreciate your work, knowledge and passion for security. We are happy to work with everyone who submits valid reports to help improve our security. With that said, only those that meet the following eligibility requirements may receive monetary reward.

• Rate limiting of automatic testing tools to a maximum of 10 requests per second
• Disclosure of the vulnerability report is made exclusively through YWH
• The report shall include a clear description including the steps to reproduce the vulnerability together with necessary attachments such as screenshots, proof of concept code or similar
• You need to be the first person to report an unknown issue
• You need to report any vulnerability found not later than 24 hours after discovery
• You are not allowed to perform any type of Denial of Service attack or tests that could cause degradation or interruption of our service
• You are not allowed to leak, manipulate or destroy any user data
• You are not allowed to publicly disclose a bug before it has been fixed
• You are not allowed to attempt non-technical attacks such as social engineering, phishing, etc
• You are only allowed to test against accounts you own yourself
• You must not be a former or current ATG employee/contractor

Sometimes our teams are already aware and working on a vulnerability before you reported it. In that case we will recognize your work and thank you but the report will not be eligible for a reward.

Note that disclosing details, conversations or other information that have negative impact on the program or ATG brand will result in immediate disqualification from the program.

Reports of leaks and exposed credentials

We are open to some types of reports related to exposed secrets, credentials or information.
Please pay attention to our list of Qualifying/Non-Qualifying vulnerabilities, as well as our Scope and the following rules.

In order not to encourage dark and grey economies, in particular the purchase, resale and trade of identifiers or stolen information, as well as all types of dangerous behavior (e.g. social engineering, ...), we will not accept or reward any report based on information whose source is not the result of failure on the part of our organization or one of our employees/service providers.

Eligible Reports

Reports of exposed secrets, credentials and sensitive information will be considered eligible if it complies with the following:

• The source of exposure/leak is under ATG’s control, directly or indirectly.
  e.g. stolen or bundled information from a random source is not eligible.
• The exposed information has been verified (or tested) and confirmed.

  To summarize our policy, you may refer to this table

  	Source of leak is in-scope	Source of leak belongs to ATG but is out-of-scope	Source of leak does not belong to ATG and is out-of-scope
  Impact is in-scope (e.g. valid credentials on an in-scope asset)	Eligible	Eligible	Not Eligible
  Impact is out-of-scope (e.g. valid credentials for an out-of-scope asset)	Eligible	Not Eligible	Not Eligible

  Important precautions and limitations

  As a complement to the Program’s rules and testing policy:

• DO NOT alter compromised accounts by creating, deleting or modifying any data
• DO NOT use compromised accounts to search for post-auth vulnerabilities (they won’t be eligible anyway)
• DO NOT include Personally Identifiable Information (PII) in your report and please REDACT/OBFUSCATE the PII that is part of your PoC (screenshot, server response, JSON file, etc.) as much as possible.
• In case of exposed credentials or secrets, limit yourself to verifying the credentials validity
• In case of sensitive information leak, DO NOT extract/copy every document or data that is exposed and limit yourself to describe and list what is exposed.

Scope

Only defined scopes are eligible for rewards. However.. Serious vulnerabilities reported on out of scope assets is currently not eligible for monetary rewards but we will try to set you up with some "cool merch" as thank you if your report result in changes on our side and evaluate to adjust our scope for the future.