Bug Bounty Program
Found a bug or a security flaw? Report it here. Once we verify it, the finding gets a severity level and you get the matching reward.
The idea is simple: a problem known to one person is worth less than a problem known to the people who can fix it.
How it works
You describe the problem and how to reproduce it. We test it, rate the severity and reply — including when the report is declined.
Cheats count too
If a cheat works on our server, we want to know. Send what it does and how it works; the reward depends on the damage it could cause.
Secrecy is part of the deal
Disclosing the flaw publicly before it is fixed forfeits the reward. That is not red tape: while the hole is open, whoever reads the notice is whoever will use it.
Out of scope
- Spam and social engineering.
- Denial of service attacks.
- Problems that do not come from our code or our configuration.
Submit a report
You need to be signed in to submit a report. Sign in