Vulnerability Reporting

This document is provided in English. If any translated summary of it exists anywhere, the English version is the one that applies.

Our Commitment

We take the security of StarView Cinema's website, app, and backend services seriously - including payment processing, account authentication, and ticket/seat integrity. We welcome reports from independent security researchers and will work with you in good faith to understand and resolve genuine issues.

How to Report

Email [email protected] with as much detail as you can provide:

• A clear description of the issue and its potential impact.
• Step-by-step reproduction instructions, including the affected endpoint, screen, or feature.
• Any proof-of-concept code, screenshots, or request/response logs that help us verify it quickly.

We aim to acknowledge every report within 3 business days.

Scope

In scope:

• Authentication, session, and account-takeover issues.
• Payment or Galaxies-balance manipulation.
• Seat/ticket integrity issues (e.g. double-booking a seat, bypassing showtime restrictions).
• Data exposure - personal information, driver application documents, or internal admin endpoints reachable without authorization.

Out of scope:

• Reports requiring physical access to a device or social engineering of StarView staff.
• Denial-of-service testing against production systems - please describe the theoretical issue instead of running it.
• Issues in third-party services we integrate with (Stripe, app stores) - please report those directly to the vendor.

Safe Harbor

We won't pursue legal action against researchers who make a good-faith effort to follow this policy: avoid privacy violations, service disruption, and data destruction, and give us a reasonable window to fix an issue before any public disclosure.