Read this before you play.

1.The short version

• Report security holes privately through our Contact page and pick Security report.
• Test only with your own accounts, and stop as soon as you've shown the problem.
• Don't touch other players' accounts or data, don't keep what an exploit gives you, and don't slow the site down.
• Keep it to yourself until we've fixed it.
• Follow these rules and we won't ban you or take legal action. Good reports earn rewards in the game, and serious ones the Whitehat badge.

2.How to report

Use our Contact page and choose Security report. One report per problem. Tell us:

• what the problem is, and what someone could do with it;
• the page, and the exact steps to make it happen again;
• what you saw (the request and the answer, or a description of the screen);
• your username, if you have one, so we know where to send a reward.

Addresses on our own site are fine to paste into the form. Never send us another player's personal information: if you came across some, say what kind it was and leave it out.

3.What happens next

• We aim to reply within 3 days to say we have it.
• We'll tell you whether we can make it happen, how serious we think it is, and when it's fixed.
• Anything that puts players' accounts or private information at risk goes to the front of the line.
• Once it's fixed we pay the reward and, if you want, add your name to the thank-you list in the Hall of Fame.

4.Testing rules

• Your own accounts only. If a test needs two players, you may make one extra test account. Name it in your report and don't play on it. (Normally one person, one account; this is the only exception.)
• Stop at the first proof. Don't keep going to see how far it goes, don't pull more than you need to show it, and don't change or delete anything that isn't yours.
• Other players' data is off limits. If you see some anyway, stop, don't keep a copy, and tell us what you saw.
• Don't keep the gains. Money, points or items an exploit gives you get taken back. Tell us and we'll put your account back the way it was; the reward comes on top.
• Go easy on the server. Scripts and scanners are allowed only for security testing on your own accounts, at no more than 5 requests a second. Everywhere else the Acceptable Use Policy still bans them.
• Keep it private until it's fixed. No posts, videos or tips to other players. If 90 days pass and it still isn't fixed, talk to us before you publish anything.

5.What counts

This covers mycriminallife.com and everything on it, including the game behind the login and the staff tools. Problems like these count:

• getting into someone else's account, or doing things as them;
• seeing private information: mail, email addresses, IP addresses, passwords, payment details;
• getting into staff tools or pages you shouldn't reach;
• making money, points or items out of nothing, or copying them;
• getting around jail, the hospital, timers, limits, or a feature that's switched off;
• putting code into pages other players see (cross-site scripting), making other players' browsers act for you (cross-site request forgery), or reaching the database through a form (SQL injection).

These usually don't earn a reward, though you're welcome to mention them:

• reports from automated scanners with no working example;
• missing "best practice" settings or headers with no real way to hurt anyone;
• things that only affect you (self-XSS), or that need someone's unlocked phone or computer;
• problems that only happen in very old or unsupported browsers;
• a visible version number, or a page that exists but shows nothing private.

6.Off limits

Never, not even to test:

• slowing down or knocking over the site: denial of service, floods, load tests;
• spam, phishing, or tricking players or staff into anything;
• guessing passwords or sign-in codes over and over (brute force);
• anything physical, or anything aimed at our homes or offices;
• other websites on our servers, and the companies we use (Cloudflare, Google, PayPal, our host). Report their problems to them;
• anything against the law.

7.Safe harbor

If you follow this page in good faith:

• we treat your testing as allowed, and we won't take legal action against you or ask anyone else to;
• we won't ban, jail or penalize your account for it, and the Acceptable Use Policy limits on testing don't apply to you while you follow this page;
• if someone else takes action against you over testing that followed these rules, we'll make it known that you had our permission.

Good faith means you were trying to find problems and tell us, not to profit from them or hurt anyone. This can't make anything illegal legal, and it can't give you permission on behalf of other companies. Not sure if something is OK? Ask first through the Contact page.

Found a hole by accident while playing normally? Report it promptly and nothing happens to you for finding it. That's in the Acceptable Use Policy too.

8.Rewards

Rewards are paid in the game, to one account in good standing, once we've confirmed the problem. The first person to report something gets the reward; later reports of the same thing get our thanks.

• We decide how serious a problem is, by what someone could actually do with it.
• For an exceptional find we may add a cash reward. That's decided case by case and isn't promised.
• Staff, and players who broke the rules on this page or are banned, can't get rewards.
• If you'd like, your name goes on the thank-you list in the Hall of Fame.

9.Ordinary bugs

A typo, a page that shows an error, a button that does nothing: use the bug report page in the game, or our Contact page if you can't sign in. There's no bounty for these, but they get fixed, and we're grateful.

A bug that pays out twice or hands out money or items is an exploit, not an ordinary bug: report it as a security report. Using it instead breaks the Game Rules.