--- title: 'Security & Responsible Disclosure' url: 'https://vllb.org/about/security' markdown: 'https://vllb.org/about/security.md' date: '2026-10-16' description: 'Found a security issue on vllb.org? Here is how to report it to Vallejo Little League responsibly, what is in scope, and how we thank researchers.' --- # Security & Responsible Disclosure Vallejo Little League is a volunteer-run, 501(c)(3) non-profit serving baseball and softball players ages 4-16. Our families trust us with their information, and we take that seriously. If you are a security researcher and you've found a vulnerability in our website, we want to hear from you, and we'll work with you in good faith to fix it. ## A note about bug bounties We're a small youth sports league. Every dollar we raise goes to equipment, uniforms, field upkeep, umpires, and scholarships for kids who couldn't otherwise play. **We're sorry, but we can't pay bug bounties.** What we *can* do is say thank you publicly. If you report a valid, previously unknown issue, we'll be glad to list you as a **Security Sponsor** on our website (name or handle, plus an optional link) alongside the local businesses who keep our league running. You've given us something valuable, and we'd like to recognize it. ## How to report Email with: - A description of the issue and the impact you think it has - The URL(s) or component affected - Steps to reproduce, or a proof of concept - How you'd like to be credited (name, handle, and optional link), or that you'd prefer to stay anonymous Please don't post details publicly or file them anywhere else until we've had a chance to fix the issue. ## What to expect from us We're volunteers, so please be patient with us. We aim to: - Acknowledge your report within **5 business days** - Keep you updated as we investigate and fix it - Let you know when it's resolved, and coordinate with you if you'd like to publish a write-up afterward We ask for up to **90 days** to fix an issue before public disclosure. If we need more time, we'll tell you why. ## Scope **In scope** - `vllb.org` and `www.vllb.org` (our main website) **Out of scope** These services are run by other companies. We'd still appreciate a heads-up at , but please report vulnerabilities directly to the vendor through its own disclosure program: - Our player and volunteer registration portal at `sc.vllb.org` (operated by Sports Connect) - Our email service and any other third-party hosted service - Little League International and District 53 websites **Not eligible for recognition** - Findings from automated scanners without a demonstrated impact - Missing security headers, cookie flags, or TLS configuration notes with no practical exploit - Clickjacking on pages with no sensitive actions - Self-XSS, logout CSRF, or issues that need physical access to a victim's device - Rate-limiting or brute-force reports without a working exploit - Vulnerabilities in outdated browsers or software versions - Reports about issues we already know about ## Rules of engagement To stay within this policy, please: - **Never access, download, or keep data that isn't yours.** Our systems may hold information about children. If you come across personal data, stop, don't copy or share it, and tell us right away. - Use the minimum testing needed to show the problem exists. - Don't run denial-of-service tests, high-volume automated scans, or anything else that could slow or take down the site for families. - Don't change or delete content, create lasting accounts or backdoors, or upload malware. - Don't try social engineering, phishing, or physical attacks against our board members, coaches, volunteers, or families. - Follow all applicable laws. ## Safe harbor If you make a good-faith effort to follow this policy, we will consider your research authorized, we won't pursue or support legal action against you, and if a third party takes action against you over research that followed this policy, we'll make it known that you acted with our permission. If you're unsure whether something is allowed, email us first and ask. ## Security Sponsors Our thanks to the people who have helped keep Vallejo Little League's website safe: *No reports yet. Be the first!* --- *Questions about this policy? Contact our Information Officer at . Last updated Friday, October 16, 2026.* --- ## Navigation - Parent: [About](https://vllb.org/about.md) - Previous: [Fields](https://vllb.org/about/fields.md)