
Epic Games
External Program
Submit bugs directly to this organization
###Program Eligibility
###What's allowed/permitted
###What's not allowed/not permitted
###Legal
What's required
You understand that you may not disclose, or permit disclosure of, your findings or contents of your submission to anyone other than Epic or the HackerOne team without prior written approval from Epic Games.
You understand that any media used to support your report should only be shared through HackerOne, and that the use of any public hosting service will be considered as unpermitted disclosure and could cause the report to be considered ineligible for bounties. If there is a need for use of a separate hosting service, please reach out to the program team for further instructions.
If you violate this agreement you will be ineligible for bounty payments, swag or any other rewards.
Please review the table below for examples of severity categories. These examples don't guarantee any bounties or severity ratings for any reports, and should only be considered as a guideline:
###General
| Description | Potential Bounty | Notes |
|---|---|---|
| Remote code execution on in-scope Epic Games game, store, other core infrastructure endpoints, or another player’s computer | $25,000 | |
| Authentication bypass on Epic Games Store Accounts | $25,000 | Does not include credential stuffing |
| Authentication bypass on Epic-owned in-scope assets/services | $15,000 | Does not include credential stuffing and/or brute force |
| Remote code execution on Epic-owned in-scope assets outside of the Epic Games core infrastructure | $15,000 | |
| Payment process bypass | $15,000 | Complete purchases in-store or in-game without payment |
| Privilege escalation on in-scope Epic services | $7,500 | |
| Product price altering | $5,000 | Complete purchases in-store or in-game with a modified price. Ex. Buy a $10 item for $1 |
| Web Cache Poisoning | $500 | Denial of service through cache poisoning |
###Fortnite
| Description | Potential Bounty | Notes |
|---|---|---|
| Being able to enumerate the server IP address of another player in real-time. | $15,000 | Online game modes, primarily ranked modes. |
| Being able to crash a server that you are not a member of | $10,000 | |
| Being able to modify a game characteristic in a previously unknown and unique way to give you a considerable gameplay advantage | $10,000 | * non-custom Solo BR match |
| Being able to crash other people | $15,000 | Severity will be assessed based on if they are part of your social party, friends or strangers. |
| Being able to crash a server you are a member of | $5,000 |
###Easy Anti Cheat
| Description | Potential Bounty | Notes |
|---|---|---|
| Local privilege escalation using the anti-cheat service or driver | $10,000 | |
| Implementation details of a previously unknown and unique method for injecting cheats or otherwise accessing the game’s memory | $5,000 | |
| Implementation details of a previously unknown and unique method for preventing anti-cheat detections | $5,000 | |
| Implementation details of a previously unknown and unique method for spoofing or hiding hardware identifiers | $5,000 |
###Denial of Service
| Description | Max Severity |
|---|---|
| Single, small request to Fortnite game services resulting in matchmaking outage | Critical |
| Single, small request to Fortnite game services resulting in outage to specific region | Critical |
| Unintended large (5k+ character) requests to game endpoint causing delays or loss of service | High |
| DoS on developer facing services without game services impact | High |
| DoS on components of non-player facing services | Medium |
| DDoS | Invalid |
We generally follow the OWASP Top 10 Application Security Risks, however, we would still love to hear from you in the event that you discover a vulnerability that is out of scope. Eligibility and bounties for any finding that is not explicitly in scope will be defined by the Epic Games team. This includes any acquisition, affiliate, or subsidiary that is not under the in-scope list.
Unreal Revision Control (URC), Unreal Engine Projects, and other User Generated Projects:
Vulnerable Network Connection in Client Applications: Vulnerabilities that require being on the same network as a victim (“Man-In-The-Middle” -MITM- attack) will be considered on a case by case basis.
Insecure Direct Object Reference (IDOR) vulnerability reports will be accepted only if the researcher is able to demonstrate a way to reliably obtain/guess/craft target IDs, or when demonstrating a High severity Impact.
For different attack vectors that result in the same mitigation, we reserve the right to reward the first report that is validated for that fix. All subsequent reports addressed by that mitigation will be considered duplicates, regardless of the attack vector.
Missing or faulty Rate-limit issues will only be considered valid when affecting login or critical account related requests, and these do not include any form of 2FA. In case the 2FA control in place is also vulnerable, the issue will be assessed on a case by case basis. A valid PoC will also be required to contain: * Proof of at least 1000 accepted requests by the server in a very short time-frame. * Proof of successful login or completion of operation after said 1000+ requests.
Web Cache Poisoning/Deception issues will only be considered valid when:
Any exploitable Zero Day vulnerabilities will only be valid if also reported to the corresponding maintainer or owner of said software/service. Zero day findings are not eligible for awards unless discovered on an in-scope asset more than 30 days after the zero day has been disclosed to the public.
Cache poisoning-based denial of service attacks will be classified as low severity. If the resulting impact causes a significant service disruption for our players and/or creators then the severity will be re-evaluated.
Findings derived from application based Denial of Service (DoS) will only be valid when not relying on volumetric attacks and triaged based on factors including ease to exploit, impact, and importance of the affected service.
Services which directly correlate to game services and game functionality generally have a higher impact than other services that would have little impact on player experience. Backend services which do not immediately impact the operation of game sessions will be considered a lower impact than those which have a direct impact on player/game experience.
Complexity of DoS is taken into account when assessing severity. Attacks which require consistent, repeated large payloads will max out at a severity of “High” unless there is substantial player impact.
Dependency confusion submissions are only valid for first party dependencies. These submissions will receive a maximum severity rating of "Informative" unless evidence is provided which shows download attempts on Epic owned infrastructure.