Responsible disclosure
Help us keep the table safe.
If you believe you found a security issue in a Four of Hearts product or website, share enough detail for the team to investigate safely.
Report privately
Email support@4ohi.com with the affected game or page, a concise description, reproduction steps, expected impact, and safe supporting evidence.
Please do not
- Access, change, or retain data that is not yours.
- Disrupt service, automate destructive traffic, or attempt social engineering.
- Publish sensitive details before the company has had a reasonable opportunity to investigate.
- Send credentials, private keys, recovery codes, or unrelated personal information.
Current program limits
Four of Hearts does not promise a bug bounty, payment, guaranteed response time, or protection for activity that breaks the law or harms other people. Internal Alpha services and policies may change.
Website security posture
The site is static, uses local scripts and assets, and has no form backend, visitor account, analytics, ad code, social widget, dynamic HTML from visitors, or evaluation of supplied code. One first-party preference cookie is created only when a visitor asks us to remember that optional cookies remain off. GitHub Pages does not expose arbitrary custom response-header controls, so the site does not claim headers the host cannot configure.