Klei Entertainment bug bounty programs

Out of scope 18

Don't test these. A program can exclude a host another program covers; the program you report to decides.

• Any activity that could lead to the disruption of our service (DoS).

• Attacks requiring MITM or physical access to a user's device.

• Attacks requiring the use of mods in one of our games

• Clickjacking on pages with no sensitive actions

• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS

• Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions

• Issues that require unlikely user interaction

• Missing best practices in Content Security Policy.

• Missing best practices in SSL/TLS configuration.

• Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)

• Open redirect - unless an additional security impact can be demonstrated

• Previously known vulnerable libraries without a working Proof of Concept.

• Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.

• Rate limiting or bruteforce issues on non-authentication endpoints

• Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).

• Tabnabbing

• Vulnerabilities in the games themselves (rather than the backend services for these games)

• Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]