Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Epic Games bug bounty programs

epicgames.com Updated

Epic Games runs two public programs: a HackerOne bug bounty paying up to $25,000 and a HackerOne disclosure program with no cash rewards.

Top reward
$25,000
HackerOne
Programs
2
1 pays cash
Targets in scope
131
7 types, deduplicated
Last change
6 Nov 2026
6 days ago

Where to report

2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.

Start here

Epic Games

HackerOne · Pays the most of the 2 programs: up to $25,000.
  • Epic Games

    HackerOne · Bug bounty

    Open

    Top reward

    $25k
    Critical
    $25k (highest)
    High
    $10k (highest)
    Medium
    $3,000 (highest)
    Low
    $500 (highest)
  • Epic Games VDP

    HackerOne · Disclosure only

    Open

    Top reward

    No cash
    First response
    5 days promised

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

131 targets across all 2 programs, each listed once with the programs that cover it. 101 excluded.

No target matches. Try part of a host name, such as the company name.

Out of scope 101

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • *.bandcamp.com

    Epic Games Epic Games VDP

  • *.bcbits.com

    Epic Games

  • *.corp.bandcamp.com

    Epic Games VDP

  • *.jellychat.com

    Epic Games

  • *.popjam.com

    Epic Games Epic Games VDP

  • *.rukkaz.com

    Epic Games VDP Epic Games

  • *.superawesome.com

    Epic Games Epic Games VDP

  • *.superawesome.tv

    Epic Games Epic Games VDP

  • *.superbeatsports.com

    Epic Games

  • admin-dev.harmonixmusic.com

    Epic Games

  • admin.harmonixmusic.com

    Epic Games

  • answers.unrealengine.com

    Epic Games

  • artportal.epicgames.com

    Epic Games

  • audica-live-admin.hmxwebservices.com

    Epic Games

  • audica-prod-admin.hmxwebservices.com

    Epic Games

  • audica-prod-api.hmxwebservices.com

    Epic Games

  • autodiscover.harmonixmusic.com

    Epic Games

  • azure-int-proxy.hmxservices.com

    Epic Games

  • communities.unrealengine.com

    Epic Games

  • communityportal.epicgames.com

    Epic Games

  • confluence.harmonixmusic.com

    Epic Games

  • damascushelp.epicgames.com

    Epic Games

  • dcvr-live-admin.hmxwebservices.com

    Epic Games

  • dcvr-prod-admin.hmxwebservices.com

    Epic Games

  • detroitlabs.epicgames.com

    Epic Games

  • docs.superawesome.tv

    Epic Games

  • docs.unrealengine.com

    Epic Games

  • dropmix-dev-admin.hmxwebservices.com

    Epic Games

  • dropmix-prod-admin.hmxwebservices.com

    Epic Games

  • eoshelp.epicgames.com

    Epic Games

  • epicsupport.force.com

    Epic Games

  • epicswag.com

    Epic Games

  • facebook.aquiris.com.br

    Epic Games

  • forums.unrealengine.com

    Epic Games

  • fuser-admin-dev-external.hmxservices.com

    Epic Games

  • fuser-admin-live-external.hmxservices.com

    Epic Games

  • http://brand.epicgames.com

    Epic Games

  • http://superawesome.com/contact-us

    Epic Games

  • hype-dev-admin.hmxwebservices.com

    Epic Games

  • isitbandcampfriday.com

    Epic Games

  • issues.unrealengine.com

    Epic Games

  • jira.harmonixmusic.com

    Epic Games

  • learn.unrealengine.com

    Epic Games

  • locustus.harmonixmusic.com

    Epic Games

  • login.epicgames.com

    Epic Games

  • logstash-shipper-azure.hmxservices.com

    Epic Games

  • looneytuneswom.com

    Epic Games

  • mail.harmonixmusic.com

    Epic Games

  • marketplacehelp.epicgames.com

    Epic Games

  • mediaspace.unrealengine.com

    Epic Games

  • merch.fortnite.com

    Epic Games

  • mithrilhelp.epicgames.com

    Epic Games

  • mon.hmxservices.com

    Epic Games

  • msoid.harmonixmusic.com

    Epic Games

  • msoid.hmxservices.com

    Epic Games

  • news.capturingreality.com

    Epic Games

  • public-web-swarm-cluster.hmxservices.com

    Epic Games

  • rb4-admin.hmxservices.com

    Epic Games

  • rb4ca-prod-admin.hmxwebservices.com

    Epic Games

  • rb4ca-staging-admin.hmxwebservices.com

    Epic Games

  • senior.aquiris.com.br

    Epic Games

  • skookum.chat

    Epic Games

  • sompmgr-admin.hmxservices.com

    Epic Games

  • sompmgr-dev-proxy-aws.hmxservices.com

    Epic Games

  • sompmgr-dev-proxy-azure.hmxservices.com

    Epic Games

  • sompmgr-dev.hmxservices.com

    Epic Games

  • sompmgr-frontend.hmxservices.com

    Epic Games

  • sompmgr-int-dev.hmxservices.com

    Epic Games

  • sompmgr-int.hmxservices.com

    Epic Games

  • sompmgr-proxy-ext-dev.hmxservices.com

    Epic Games

  • sompmgr-proxy-ext.hmxservices.com

    Epic Games

  • sompmgr-proxy-int-dev.hmxservices.com

    Epic Games

  • sompmgr-proxy-int.hmxservices.com

    Epic Games

  • sompmgr.hmxservices.com

    Epic Games

  • songsdb.harmonixmusic.com

    Epic Games

  • stadiahelp.epicgames.com

    Epic Games

  • start.gg

    Epic Games

  • support.capturingreality.com

    Epic Games

  • support.harmonixmusic.com

    Epic Games

  • swarm-monitoring-node-01.hmxservices.com

    Epic Games

  • swarm.harmonixmusic.com

    Epic Games

  • tableau.harmonixmusic.com

    Epic Games

  • teamcity-external.harmonixmusic.com

    Epic Games

  • teamcity.hmxservices.com

    Epic Games

  • twinmotionhelp.epicgames.com

    Epic Games

  • udn.unrealengine.com

    Epic Games

  • unrealfest.unrealengine.com

    Epic Games

  • vimeo.aquiris.com.br

    Epic Games

  • watch.fortnite.com

    Epic Games

  • web-admin.harmonixmusic.com

    Epic Games

  • webinars.unrealengine.com

    Epic Games

  • www-api.hmxservices.com

    Epic Games

  • app.playwonderbox.com

    Epic Games

  • https://github.com/EpicGames/UnrealTournament

    Epic Games

  • FortniteClient-Mac-Shipping.app

    Epic Games

  • Adobe Flash related submissions

    Epic Games

  • maestro.io

    Epic Games

  • Not owned/managed by Epic Games

    Epic Games

  • Popjam Android application

    Epic Games VDP Epic Games

  • Recent Acquisitions

    Epic Games

  • Rukkaz Android application

    Epic Games Epic Games VDP

Recent changes

Reward and scope changes across every Epic Games program, newest first.

  • Epic Games

    Scope + HackerOne

    Added to scope: Zenserver

All changes · RSS feed

Recent CVEs

Published vulnerabilities in Epic Games products, from the NVD.

Search NVD
  • CVE-2024-11872 High

    Epic Games Launcher Incorrect Default Permissions Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Epic Games Launcher. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product installer. The

  • CVE-2024-11872 High

    Epic Games Launcher Incorrect Default Permissions Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Epic Games Launcher. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product installer. The

  • CVE-2018-17707 High

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Epic Games Launcher versions prior to 8.2.2. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handler for the com.epicgames.launcher protocol. A crafted URI with the com.epicgames.l

  • CVE-2018-17707 High

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Epic Games Launcher versions prior to 8.2.2. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handler for the com.epicgames.launcher protocol. A crafted URI with the com.epicgames.l

  • CVE-2010-2702 High

    Buffer overflow in the UGameEngine::UpdateConnectingMessage function in the Unreal engine 1, 2, and 2.5, as used in multiple games including Unreal Tournament 2004, Unreal tournament 2003, Postal 2, Raven Shield, and SWAT4, when downloads are enabled, allows remote attackers to execute arbitrary code via a long LEVEL field in a WELCOME response to a download request.

  • CVE-2010-2702 High

    Buffer overflow in the UGameEngine::UpdateConnectingMessage function in the Unreal engine 1, 2, and 2.5, as used in multiple games including Unreal Tournament 2004, Unreal tournament 2003, Postal 2, Raven Shield, and SWAT4, when downloads are enabled, allows remote attackers to execute arbitrary code via a long LEVEL field in a WELCOME response to a download request.

  • CVE-2008-6441 High

    Format string vulnerability in the Epic Games Unreal engine client, as used in multiple games, allows remote servers to execute arbitrary code via (1) the CLASS parameter in a DLMGR command, (2) a malformed package (PKG), and possibly (3) the LEVEL parameter in a WELCOME command.

  • CVE-2008-6441 High

    Format string vulnerability in the Epic Games Unreal engine client, as used in multiple games, allows remote servers to execute arbitrary code via (1) the CLASS parameter in a DLMGR command, (2) a malformed package (PKG), and possibly (3) the LEVEL parameter in a WELCOME command.

About this page

This page gathers every public program listed under epicgames.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.