Security

Reporting a vulnerability

If you believe you have found a security issue, email [email protected] with the steps to reproduce it. We acknowledge reports within three working days and keep you informed until the issue is fixed. Our contact details are also published in /.well-known/security.txt.

Please act in good faith:

• Only test against your own accounts, and never access other players’ data.
• Don’t degrade the service (no denial-of-service, spam or automated flooding).
• Give us reasonable time to fix an issue before disclosing it publicly.

We will not pursue or support legal action against research that follows these rules. mulletbet uses play money only, so there are no real-money rewards; we are happy to credit researchers who agree to be named.

How we protect your account

• Passwords are hashed with Argon2id and checked against common-password lists.
• Optional two-factor authentication (TOTP) with single-use recovery codes.
• Sessions can be reviewed and ended from Account → Settings; changing your password signs out every other device.
• All balance changes go through an append-only, double-entry ledger.
• Every game result can be verified independently on the provably fair page.
• Staff access requires two-factor authentication and every staff action is logged.