Security & Responsible Disclosure

Vallejo Little League is a volunteer-run, 501(c)(3) non-profit serving baseball and softball players ages 4-16. Our families trust us with their information, and we take that seriously. If you are a security researcher and you've found a vulnerability in our website, we want to hear from you, and we'll work with you in good faith to fix it.

A note about bug bounties

We're a small youth sports league. Every dollar we raise goes to equipment, uniforms, field upkeep, umpires, and scholarships for kids who couldn't otherwise play. We're sorry, but we can't pay bug bounties.

What we can do is say thank you publicly. If you report a valid, previously unknown issue, we'll be glad to list you as a Security Sponsor on our website (name or handle, plus an optional link) alongside the local businesses who keep our league running. You've given us something valuable, and we'd like to recognize it.

How to report

Email with:

  • A description of the issue and the impact you think it has
  • The URL(s) or component affected
  • Steps to reproduce, or a proof of concept
  • How you'd like to be credited (name, handle, and optional link), or that you'd prefer to stay anonymous

Please don't post details publicly or file them anywhere else until we've had a chance to fix the issue.

What to expect from us

We're volunteers, so please be patient with us. We aim to:

  • Acknowledge your report within 5 business days
  • Keep you updated as we investigate and fix it
  • Let you know when it's resolved, and coordinate with you if you'd like to publish a write-up afterward

We ask for up to 90 days to fix an issue before public disclosure. If we need more time, we'll tell you why.

Scope

In scope

  • vllb.org and www.vllb.org (our main website)

Out of scope

These services are run by other companies. We'd still appreciate a heads-up at , but please report vulnerabilities directly to the vendor through its own disclosure program:

  • Our player and volunteer registration portal at sc.vllb.org (operated by Sports Connect)
  • Our email service and any other third-party hosted service
  • Little League International and District 53 websites

Not eligible for recognition

  • Findings from automated scanners without a demonstrated impact
  • Missing security headers, cookie flags, or TLS configuration notes with no practical exploit
  • Clickjacking on pages with no sensitive actions
  • Self-XSS, logout CSRF, or issues that need physical access to a victim's device
  • Rate-limiting or brute-force reports without a working exploit
  • Vulnerabilities in outdated browsers or software versions
  • Reports about issues we already know about

Rules of engagement

To stay within this policy, please:

  • Never access, download, or keep data that isn't yours. Our systems may hold information about children. If you come across personal data, stop, don't copy or share it, and tell us right away.
  • Use the minimum testing needed to show the problem exists.
  • Don't run denial-of-service tests, high-volume automated scans, or anything else that could slow or take down the site for families.
  • Don't change or delete content, create lasting accounts or backdoors, or upload malware.
  • Don't try social engineering, phishing, or physical attacks against our board members, coaches, volunteers, or families.
  • Follow all applicable laws.

Safe harbor

If you make a good-faith effort to follow this policy, we will consider your research authorized, we won't pursue or support legal action against you, and if a third party takes action against you over research that followed this policy, we'll make it known that you acted with our permission. If you're unsure whether something is allowed, email us first and ask.

Security Sponsors

Our thanks to the people who have helped keep Vallejo Little League's website safe:

No reports yet. Be the first!

Questions about this policy? Contact our Information Officer at . Last updated Friday, October 16, 2026.