SECURITY TESTING
Red team Arcades.
This is a fictional signup demo. We invite independent security testing of the demo and its verification flow. No real sportsbook account, credits, wager, or prize is involved.
One hard rule: no denial-of-service. Do not use distributed denial-of-service, traffic floods, resource exhaustion, or other tests intended to make the demo unavailable.
01 / TARGET
What is in scope
signup.arcades.click, including the signup form,
first-party API, session handling, and gated success page. The
Fortress Captcha and passkey flow initiated by this page is also
in scope as part of an Arcades signup session.
This policy does not authorize unrelated systems, other customers, or direct testing of cloud providers and their shared services.
02 / METHODS
What you can try
Within scope, use any technique except denial-of-service: automation, fuzzing, malformed requests, exploit attempts, session attacks, QR and passkey bypasses, and client-side manipulation are welcome. No advance permission is needed.
The form accepts made-up names and email addresses. Please use fictional details in your test sessions.
03 / FINDINGS
Send us what you find.
Email the affected URL, steps to reproduce, and any useful evidence. Put “Arcades security” in the subject so we can find it.