Security Practices
Account protection, responsible disclosure and service boundaries.
Protecting access
Use a strong unique password and enable multi-factor authentication where offered. Keep control-panel credentials and API keys private. Blacktop’s staff billing console requires staff two-factor enrollment.
System scope
Blacktop uses HTTPS for its public website, portal, billing login and game panel; system services include Nginx, Paymenter and Pterodactyl. The company runs scheduled local backup and reachability jobs. These controls do not amount to a guarantee against every breach or outage.
Report a vulnerability
If you believe you have discovered a security issue, contact the operator through the contact page and use “Responsible Security Disclosure” as the subject. Include reproduction steps and an impact explanation, but do not exfiltrate data, disrupt services or publish proof-of-concept exploits involving real user accounts.
No bug bounty or safe harbor promised
This notice is not a standing authorization for invasive security tests or a paid bug-bounty program. Ask for written permission before testing beyond ordinary use.
Account-level controls
The public marketing site has no login. Separate billing and game management systems have authentication requirements. Staff roles in Paymenter do not confer Linux, SSH or game-panel permissions.