Responsible disclosure

How to report

Email security@allurestream.com with a clear description, the steps to reproduce, and the impact you believe the issue has. Machine-readable contact details are published at /.well-known/security.txt.

Please report privately first and give us a reasonable window to fix the issue before publishing anything.

What to expect

We aim to acknowledge a report within 3 business days and to give you a first assessment within 10 business days.

We will tell you when the issue is fixed, and we are happy to credit you unless you prefer to stay anonymous.

In scope

allurestream.com and its API endpoints, authentication and session handling, access-control and data-isolation issues, payment and payout integrity, and protected video playback.

Out of scope

Denial-of-service or volumetric testing, social engineering of staff or members, physical attacks, spam or automated scanner output without a demonstrated impact, and issues in third-party services we do not control.

Ground rules

Do not access, modify or delete data that is not yours. Use only test accounts you created. Do not attempt to move real money. Stop as soon as you have demonstrated the issue and tell us.

Acting in good faith under these rules, we will not pursue legal action over your research.