Report Security Issues
Last Updated: November 2026
If you have found a security vulnerability affecting TCG Poké Cards, please contact us at support@tcgpokecards.shop. We review legitimate reports and aim to address confirmed issues promptly.
Before reporting, please review our fundamentals, bounty programme, and reward guidelines below.
Fundamentals
If you act in good faith and comply with this policy and applicable laws, TCG Poké Cards will not initiate civil legal action or request a law-enforcement investigation solely because of your compliant security research or report.
This commitment concerns our own actions. It does not bind third parties or provide immunity from applicable law.
This policy applies only to website systems owned or controlled by TCG Poké Cards. It does not authorize testing of payment providers, hosting infrastructure, or other third-party systems. If you are unsure whether a system or activity is covered, contact us before testing.
When reporting a security issue, you must:
- Give us reasonable time to investigate and address the issue before publicly disclosing it or sharing it with others.
- Avoid accessing or interacting with private accounts without the account owner’s consent.
- Make a good-faith effort to avoid privacy violations, service disruptions, and data destruction.
- Limit testing to what is necessary to identify and report the issue.
- Avoid exploiting a vulnerability to gain further access, obtain sensitive information, or demonstrate additional harm.
- Stop testing and notify us immediately if you encounter personal information or other sensitive data.
- Comply with applicable laws and regulations.
Denial-of-service attacks, social engineering, phishing, and destructive testing are not authorized by this policy.
Bounty Programme
TCG Poké Cards may recognize and reward security researchers who help protect our website by responsibly reporting vulnerabilities.
Bounties are awarded at our discretion, based on the vulnerability’s risk, impact, exploitability, and the quality of the report.
To be considered for a bounty, you must:
- Follow the fundamentals listed above.
- Report a valid, reproducible security vulnerability that poses a risk to privacy or security.
- Submit your report to support@tcgpokecards.shop, using the subject line “Security Vulnerability Report.”
- Include sufficient information for us to understand and reproduce the issue without exposing sensitive information.
- Disclose any accidental privacy violations, data access, or service disruptions associated with your testing.
- Allow reasonable time for investigation and remediation.
We prioritize reports according to risk. Response and resolution times may vary.
We may publish a summary of a resolved report after removing personal information, sensitive data, and details that could create an ongoing security risk.
Rewards
Rewards depend on the confirmed impact and severity of the vulnerability. Reports must include clear, reproducible steps.
Issues that cannot be reproduced are not eligible for a monetary bounty.
Only the first valid report of an issue is eligible for a bounty. Multiple findings caused by the same underlying issue may be treated as a single report.
The following amounts are maximum potential rewards, not guaranteed payments:
Critical Severity — Up to $200
Examples include remote code execution, remote command execution, vertical authentication bypass, SQL injection exposing sensitive data, or vulnerabilities enabling full account compromise.
High Severity — Up to $100
Examples include lateral authentication bypass, disclosure of sensitive internal information, stored cross-site scripting affecting other users, local file inclusion, or insecure handling of authentication cookies.
Medium Severity — Up to $50
Examples include security-relevant business-logic flaws and insecure direct object references with a demonstrated impact.
Low Severity — Recognition Only
Examples may include low-impact open redirects, reflected cross-site scripting, and low-sensitivity information disclosures.
Final severity and reward decisions depend on the actual impact, exploitability, affected systems, and quality of the report.
Contact Information
TCG Poké Cards
Address:
200 S Reynolds St
Alice, TX 78332
United States
Phone: +1 (956) 631-8475
Email: support@tcgpokecards.shop
Business Hours:
Monday–Friday: 9:00 AM–10:00 PM Central Time
Saturday–Sunday: Closed