Security policy

The scope of this policy, what a security report holds, and the state of the reporting inbox.

Scope

In scope: This site: every page and file it serves, and the response headers it sends with them.
Not in scope: The desktop app of LANEGAP. It is not public. Services of Riot Games are not in scope either.

Reporting

Inbox: No reporting inbox is published yet. One is listed on this page before the app's public release.
Reward: There is no reward programme. A report earns no payment.
Machine-readable: /.well-known/security.txt points to this page.

A report

A report that can be acted on holds four things.

Where: the address of the page or file, and the response header when one is involved.
Steps: what to do, in order, to see the problem again.
Impact: what an attacker gains, and from which position.
Setup: the browser with its version, and the operating system.