Security
How to report a problem, and what we do about it.
If you have found a security problem in Courtsbook, please write to security@courtsbook.com. Last updated 3 August 2026.
What we ask
- Give us a reasonable chance to fix it before telling anyone else.
- Use your own account and your own club. Please don’t read, change or delete anyone else’s data to prove a point — tell us what you believe is possible and we will check it ourselves.
- No denial of service, no spam, no social engineering of our members or staff.
What you can expect
- An acknowledgement within two working days.
- An honest assessment — including if we disagree that it is a problem, and why.
- Credit in the fix if you would like it, and none if you would rather stay anonymous.
We are a small company and we do not run a paid bounty programme. We would rather say that plainly than imply one.
What we care most about
Courtsbook holds member contact details, private messages between club members, and an optional match-day location beacon that members switch on themselves. Clubs are meant to be sealed off from one another. If you have found a way to read across clubs, that is the finding we most want to hear about — ahead of anything else on this page.
How the app is built
- Sign-in is a six-digit code to an email address or phone number, with an optional password. There is no third-party sign-in and no open registration — accounts exist by invitation, by application to a league, or by a club subscribing.
- Data lives in Postgres with row-level security enabled on every table, checked at build time.
- Traffic is HTTPS only. Passwords and codes are handled by our authentication provider; we never see or store a password.
- Payment details are not stored by us at all.
Out of scope
Reports generated solely by an automated scanner with no demonstrated impact, missing hardening headers with no exploit path, and issues in third-party services we consume rather than operate.
Capitol City Data, LLC, Baton Rouge, Louisiana. Privacy questions belong at privacy@courtsbook.com; anything about a member’s safety at support@courtsbook.com.