Rules for security testing

Test only with accounts you own, stop as soon as you've shown the bug, and tell us before anyone else. Follow these rules and we treat your research as authorized. See Safe harbor for security research.

What you can test

• shaftkings.gg and every *.shaftkings.gg site we run, with their API and the live connection the games use.
• Signing in, two-factor, sessions and account settings.
• Deposits, withdrawals and tips, with small amounts.
• Our Originals, provably fair, rakeback, promo codes and the affiliate program.

What's off limits

• Anything that slows the site down or takes it down for other players: load tests, floods or denial of service. Tell us how instead.
• Other players' accounts, money or details. If you need a second account to test between accounts, ask us for one.
• Tricking our team or our players, by chat, email or phone.
• Automated scanning faster than 5 requests a second.
• The slot and live casino games, which other companies run, and the companies that handle our payments, chat and hosting.
• Getting around our location blocks with a VPN. Ask us for access instead.

If a bug pays you

1. Stop. Don't repeat it, and don't bet or withdraw what it gave you.

2. Email security@shaftkings.gg straight away, with what happened.

3. We reverse what the bug gave you, refund any of your own money it took, and pay the reward instead.

Under our Terms of Service, bets placed because of an error can be voided. If you use a bug to win, or withdraw what it gave you, you lose any reward and we can close your account.

Testing money

Need a balance to test with that isn't your own money, or a second account? Email us before you start and we'll set it up.

Keep it private

Don't share a bug with anyone until we've fixed it. We'll tell you when it's fixed. To publish a write-up after that, ask us first, and we'll agree a date, normally within 30 days of the fix.