Last updated: 23 October 2026
This text is translated from the Turkish original. If the two texts conflict, the Turkish original prevails.
If you have found a security vulnerability in Otenos, telling us protects both the players and the game. This page explains how to report a vulnerability and what we promise in return.
How to report
Write to security@otenos.com. Describe what the vulnerability is, how to reproduce it step by step and what it can lead to; a screenshot or a sample request speeds up our work. You can write in Turkish or English.
Scope
The game and the site: otenos.com and its subdomains, the game's interface and its API.
The systems of the companies that provide our payment and email services are out of scope; report any vulnerability you find in them directly to them. Game balance, cheating suspicions and player reports are not security vulnerabilities either; the Support page is there for those.
What you must not do
- Put load on the service that would slow it down or stop it.
- Access another player's account; view, change or download their data. Use only your own accounts to demonstrate the vulnerability.
- Phishing or social engineering aimed at players or at us.
- Use the vulnerability to gain an advantage in the game, or let someone else use it.
- Share the vulnerability anywhere public before we have fixed it.
Our promise
- We confirm receipt of your report within 3 business days.
- We keep you informed while we investigate and let you know when we have fixed it.
- We will not take legal action over research done in good faith and within the rules on this page.
- We keep your report confidential until the vulnerability is fixed.
Thanks
We do not pay cash rewards. Anyone who reports a valid vulnerability is named, if they wish, in the thank-you list on this page.
The list is still empty; the first name on it could be yours.
Contact
For security reports: security@otenos.com