How best to report vulnerabilities?

[danadc]

Well this thread is very good, but before continuing to see suggestions, what casinos offer rewards or incentives to report these bugs? I don't know of any casino that says that any bug they suggest will be rewarded, because most players or those people who are in casinos and get vulnerabilities don't report them but exploit them, because that way they get a lot of money, and that's what they do. You have to change the casinos, so they protect themselves twice so that they are reported and so that they no longer have this type of problem, in everything that is online there will always be vulnerabilities, but if they do not offer good rewards it will not be attractive to some.

[1715326996]

1715326996

[Dunamisx]

The best way is to engage their discussion thread here on the gambling section or contact their representative, also if the case involved is beyond an ordinary report then one can open a reputation thread against them and present your take, we cannot expect all the casinos or gambling organizations to function the same way we have with others and as for those not on the forum here, it may be difficult to get across to them since they know that they already had a vulnerability, they wouldn't respond to your complaints and this is part of the risk associated to using casinos we aren't sure about their reputation.

[Yatsan]

The best way is to engage their discussion thread here on the gambling section or contact their representative, also if the case involved is beyond an ordinary report then one can open a reputation thread against them and present your take, we cannot expect all the casinos or gambling organizations to function the same way we have with others and as for those not on the forum here, it may be difficult to get across to them since they know that they already had a vulnerability, they wouldn't respond to your complaints and this is part of the risk associated to using casinos we aren't sure about their reputation.

As @uneng have mentioned in this topic, the thread was already locked by project manager which seems to me that they don't have actions yet or are just disregarding their players' concern. In this case, moving to another gambling platform would be a better idea than to wait for them to solve the issues; that is their responsibility in the first place and that is not something a player should still ask for them. Bugs and other 'glitches' are somewhat normal for new projects especially we are talking about online platform wherein servers are huge. But their action would speak louder than their words for sure.

[AmoreJaz]

The best way is to engage their discussion thread here on the gambling section or contact their representative, also if the case involved is beyond an ordinary report then one can open a reputation thread against them and present your take, we cannot expect all the casinos or gambling organizations to function the same way we have with others and as for those not on the forum here, it may be difficult to get across to them since they know that they already had a vulnerability, they wouldn't respond to your complaints and this is part of the risk associated to using casinos we aren't sure about their reputation.

As @uneng have mentioned in this topic, the thread was already locked by project manager which seems to me that they don't have actions yet or are just disregarding their players' concern. In this case, moving to another gambling platform would be a better idea than to wait for them to solve the issues; that is their responsibility in the first place and that is not something a player should still ask for them. Bugs and other 'glitches' are somewhat normal for new projects especially we are talking about online platform wherein servers are huge. But their action would speak louder than their words for sure.

if the site rep/admin or any other staff from the casino ignores the situation, better move on as they are not interested to address the given problem. or better yet, they don't want to give reward to the person who found the bug, and they will just address it silently. but if the bug is still there, better play on another site which you think is taking care of its customers.

[adzino]

So I discovered a bug affecting a mode of play at OwlGames casinos that results in certain games rewarding more money than they should.  I tried to report it to OwlGames but was told that they have no bug bounty program and to "enjoy the bug" (not kidding).  (of course their docs say that any "exploit" can result in not being paid out, but it's not an exploit if it's simply how things run under the given conditions - not that that would stop them from screwing someone over I'm sure)

Their poor attitude certainly doesn't do much to make me want to help them out anymore although that was my intent. 

But since it is only certain games, from 1 provider, should I try to contact that provider instead?  It's possible I imagine that it's not just OwlGames that might possibly lose money to the issue, though I really don't know.

I guess since these are casinos, losing a couple hundred to a few players every few days that would otherwise not have won anything maybe is just a drop in the bucket.  But I found it so strange that they immediately just alerted me that they have no bounty program.  Aren't casinos supposed to be pretty protective of their money even if they have a ton of it? 

Anyone else have any experiences of trying to report issues like this?  I want to be rewarded for my time verifying the issue without taking advantage of it and alerting someone about it, too, so I'm also just worried about giving the info out and having them come up with some excuse like "oh it just needed a restart it's fine now, that's not a bug."

I doubt any legit casino would say something like "enjoy the bug" or have no bug bounty program. Or maybe it's  a whole different story. They are aware of the bug, but they don't do anything about it. Only when someone exploits the bug, they confiscate their funds saying that they abused a bug in their casino. As long as someone is losing, they wouldn't care. If someone is winning, they can put an excuse saying that the bets are invalid due to slot malfunction (all slots literally have this rules were your bets are invalid if the slot has issues) and deny them their winnings.

Since support wasn't helpful, try contacting them here if they have an ANN thread. If nothing, I would advise you not to exploit the bug since they will end up confiscating your funds.

[Odusko]

The best way is to engage their discussion thread here on the gambling section or contact their representative, also if the case involved is beyond an ordinary report then one can open a reputation thread against them and present your take, we cannot expect all the casinos or gambling organizations to function the same way we have with others and as for those not on the forum here, it may be difficult to get across to them since they know that they already had a vulnerability, they wouldn't respond to your complaints and this is part of the risk associated to using casinos we aren't sure about their reputation.

I think ops is not making a personal claim of harm from the casino and all he want to do is to report system vulnerability to the team, so creating thread has noting to do with this and I think ops did right to open this thread so that he can take suggestions and advise from other members here who may have experienced similar system loophole before.
The best option os that ops should continue to make a support tickets, and reporting the situation.

[Plaguedeath]

Well this thread is very good, but before continuing to see suggestions, what casinos offer rewards or incentives to report these bugs? I don't know of any casino that says that any bug they suggest will be rewarded, because most players or those people who are in casinos and get vulnerabilities don't report them but exploit them, because that way they get a lot of money, and that's what they do.

Fortunejack was one of casino which run bug bounty program in the past Bug Bounty on FortuneJack | Get Rewarded for Finding Bugs, but since owlgames doesn't run bug bounty program and they're not appreciating the @OP for finding the bugs, owlgames can't be blamed in this situation since it's in grey area.

Yeah maybe those users are exploit the bugs in order to get easy money, moreover if they're have a good understanding about privacy, they can escape from chainalysis. I just hope the @OP didn't mad and exploit the bugs, although he can do that.

[kotajikikox]

Well this thread is very good, but before continuing to see suggestions, what casinos offer rewards or incentives to report these bugs? I don't know of any casino that says that any bug they suggest will be rewarded, because most players or those people who are in casinos and get vulnerabilities don't report them but exploit them, because that way they get a lot of money, and that's what they do.

Fortunejack was one of casino which run bug bounty program in the past Bug Bounty on FortuneJack | Get Rewarded for Finding Bugs, but since owlgames doesn't run bug bounty program and they're not appreciating the @OP for finding the bugs, owlgames can't be blamed in this situation since it's in grey area.

Yeah maybe those users are exploit the bugs in order to get easy money, moreover if they're have a good understanding about privacy, they can escape from chainalysis. I just hope the @OP didn't mad and exploit the bugs, although he can do that.

While OWLgames is one stablished gambling site and running their own token as well, this seems to be a insult having bug still with long experience and activities here.
but compensating the reporter would not hurt them so why need to be that acting? maybe this will let others who found bug on their site to deny letting them know and maybe will be used to attack them though i don't pay consent in this act.

[Reatim]

So I discovered a bug affecting a mode of play at OwlGames casinos that results in certain games rewarding more money than they should.  I tried to report it to OwlGames but was told that they have no bug bounty program and to "enjoy the bug" (not kidding).  (of course their docs say that any "exploit" can result in not being paid out, but it's not an exploit if it's simply how things run under the given conditions - not that that would stop them from screwing someone over I'm sure)

That is not a good attitude addressing the person concern about their business and operation , but if you are hurt because of not getting any bounty then that is their way so sorry for not having yet they are not giving any amount.

Their poor attitude certainly doesn't do much to make me want to help them out anymore although that was my intent. 

But maybe they have just react that way but deep inside they are finding that bug for their own safeties it is just they don't want to give you hints how helpful that reporting you did for them.

[len01]

I think ops is not making a personal claim of harm from the casino and all he want to do is to report system vulnerability to the team, so creating thread has noting to do with this and I think ops did right to open this thread so that he can take suggestions and advise from other members here who may have experienced similar system loophole before.
The best option os that ops should continue to make a support tickets, and reporting the situation.

but it looks like continuing to create support tickets to the dev team will only make it more complicated. because at first the OP was ignored by the team and if you keep making support tickets, it's like the team requires you to accept the report and the team can judge that OP only wants to make a profit, that's not good for me.
and it would be better to still provide personal contact information that can be contacted so that one time the team has the wrong idea they can contact the OP to continue the bug report.

[Chato1977]

The best way is to engage their discussion thread here on the gambling section or contact their representative, also if the case involved is beyond an ordinary report then one can open a reputation thread against them and present your take, we cannot expect all the casinos or gambling organizations to function the same way we have with others and as for those not on the forum here, it may be difficult to get across to them since they know that they already had a vulnerability, they wouldn't respond to your complaints and this is part of the risk associated to using casinos we aren't sure about their reputation.

Wait what are you suggesting here? OP is just disappointed to what is the response of the team towards His report on Bug in their site(maybe disappointed as he did not received a single penny for his report) but this does not even connected to bad reputation..
hope that you read the whole post and understand before replying.

[Peanutswar]

It's better if you make a comment to their thread here in the community and wait for their response if that bug doesn't have affection with the transaction and abuses the current system of their current platform I guess they will just ignore those but if you see that as critical might damage and make them lose a lot of money I guess that's the time they make an action. Better to contact their email or just the moderator in the chat if they have.

[Coin_trader]

It's better if you make a comment to their thread here in the community and wait for their response if that bug doesn't have affection with the transaction and abuses the current system of their current platform I guess they will just ignore those but if you see that as critical might damage and make them lose a lot of money I guess that's the time they make an action. Better to contact their email or just the moderator in the chat if they have.

Nope. You will just make the casino exposed to multiple abuse once the bug is critical to their security. Reporting a bug should be in private through customer support or the official email to make it discreet to other players. I believe the OP main goal for creating this thread is to get paid for reporting the bug that finds out. The only problem was casino representative ignore his findings which is why he is asking advised here. The only problem was Owl.games is already out in the forum and focus only with their social media and customer support on handling things like this.

Nevertheless, People should not expect reward on finding bug. It’s up to the casino if they will reward you or not if they don’t have bug bounty program.

[danadc]

It's better if you make a comment to their thread here in the community and wait for their response if that bug doesn't have affection with the transaction and abuses the current system of their current platform I guess they will just ignore those but if you see that as critical might damage and make them lose a lot of money I guess that's the time they make an action. Better to contact their email or just the moderator in the chat if they have.

Nope. You will just make the casino exposed to multiple abuse once the bug is critical to their security. Reporting a bug should be in private through customer support or the official email to make it discreet to other players. I believe the OP main goal for creating this thread is to get paid for reporting the bug that finds out. The only problem was casino representative ignore his findings which is why he is asking advised here. The only problem was Owl.games is already out in the forum and focus only with their social media and customer support on handling things like this.

Nevertheless, People should not expect reward on finding bug. It’s up to the casino if they will reward you or not if they don’t have bug bounty program.

I see a failure there, because we have witnessed that when there is a failure in a casino, those who discover it do not report it, but instead explode and often cause that casino to suffer losses and even go bankrupt, especially casinos that are started, if only there was a part where the casinos tell them that if they find a bug, they could reward it according to the degree of complexity, as they have established here in the forum, that if they find a bug they pay in gold terms, and that is something that motivates a lot, if there is no monetary motivation, it is very difficult for them to achieve things.

[RILWAN]

If ops have tried to reach out to tge casino involved via their support and there is no positive response, i think ops should contack tgem again, may be busy or there have not find their way around the situation so their team are just using the delayed tactic for the players so that he will not expose the venerabilities.

[nakamura12]

There's nothing you can do mate since they didn't think that you are serious about the bug that you found. Since they explained it to you that they don't have bug bounty running up. Well, it's up to you either to take advantage of the bug and won more money than it should have and good luck about not getting found out that you exploited a bug. Maybe try to make some copy or an evidence that they told you to enjoy the bug. I can also think that it could be an event of some sort if you ask me but who knows what it really is what is the situation.

[Hamphser]

If ops have tried to reach out to tge casino involved via their support and there is no positive response, i think ops should contack tgem again, may be busy or there have not find their way around the situation so their team are just using the delayed tactic for the players so that he will not expose the venerabilities.

Exposing the bug or vulnerabilities isnt really an ethical thing for you to do so for someone who do able to point out some holes on a business like this which we do know that it is really indeed that crucial.It isnt really just that too professional for them on handling it out because they arent really responding actively and trying out to resolve out those issues which it can potentially harm out the business and might end
up on having those huge withdrawals if ever OP and other people who discover would able to abuse it on their own.We dont know if op had already got some response on the team but it turns out that you had
made out some complaints or reach out too but didnt still get a reply which is really that mind boggling if you do ask me.These businesses wont really be tending to miss out these kind of
things.

[Fivestar4everMVP]

If ops have tried to reach out to tge casino involved via their support and there is no positive response, i think ops should contack tgem again, may be busy or there have not find their way around the situation so their team are just using the delayed tactic for the players so that he will not expose the venerabilities.

Well, I personally see no sense in using a delay tactics for the player since he has contacted them and was willing to report the bug to them, I believe that if he wanted to expose the bug or maybe exploit them through it, he wouldn't have bothered contacting the owl team at all.
Personally, I think the way the owl team behaved or responded to the issue is clearly unprofessional, a good company should listen to every enquiries, suggestions, reports at all time, it is not up to them to decide which is a good information they can keep and work with, and which is bad or unneeded information they can discard.

[wxa7115]

There's nothing you can do mate since they didn't think that you are serious about the bug that you found. Since they explained it to you that they don't have bug bounty running up. Well, it's up to you either to take advantage of the bug and won more money than it should have and good luck about not getting found out that you exploited a bug. Maybe try to make some copy or an evidence that they told you to enjoy the bug. I can also think that it could be an event of some sort if you ask me but who knows what it really is what is the situation.

I suppose most casinos somewhere on their TOS have a clause which allows them to void any profits the player may have gotten if they were exploiting a bug, so I doubt this is something advisable to do as you will risk your account getting banned by doing this.

I still think there is not much for the OP to do as if the developers of the casino do not even want to listen to a bug report, the OP should simply move on and let them to suffer the consequences of their carelessness.

[Odusko]

There's nothing you can do mate since they didn't think that you are serious about the bug that you found. Since they explained it to you that they don't have bug bounty running up. Well, it's up to you either to take advantage of the bug and won more money than it should have and good luck about not getting found out that you exploited a bug. Maybe try to make some copy or an evidence that they told you to enjoy the bug. I can also think that it could be an event of some sort if you ask me but who knows what it really is and what is the situation.

I suppose most casinos somewhere on their TOS have a clause which allows them to void any profits the player may have gotten if they were exploiting a bug, so I doubt this is something advisable to do as you will risk your account getting banned by doing this.

I still think there is not much for the OP to do if the developers of the casino do not even want to listen to a bug report, the OP should simply move on and let them suffer the consequences of their carelessness.

That is it, since op has made several attempts to get the attention of the team to work on the vulnerability and they refused to listen or reply him the best op can do is just to look away and not take part in those games with bugs since even if he doesn't exploit the bug to abuse the casino others will exploit the chance and ruin things for everybody who may have to take part in that particular bug games.
So to avoid getting cut up in general punishment, ops should keep reporting the bug to support and also avoid playing the game the bug if detected.