Unity Technologies bug bounty programs
unity.com Updated
Unity Technologies runs one public program: a Bugcrowd bug bounty paying up to $3,000.
- Top reward
- $3,000
- Bugcrowd
- Programs
- 1
- 1 pays cash
- Targets in scope
- 9
- 3 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program Unity Technologies runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Unity Technologies
Bugcrowd · Bug bounty |
$3,000 | $1,200 | $500 | $200 | $3,000 | Full | – | – | Open |
-
- Critical
- $3,000
- High
- $1,200
- Medium
- $500
- Low
- $200
- Safe harbor
- Full
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
9 targets.
-
https://cloud.unity.com
Web
-
https://id.unity.com
Web
-
https://pay.unity.com
Web
-
https://store.unity.com
Web
-
https://api.unity.com
APIs
-
https://services.unity.com
APIs
-
https://unity.com/download
Products and areas
-
https://unity3d.com/get-unity/download/archive
Products and areas
-
player-login.unity.com
Products and areas
No target matches. Try part of a host name, such as the company name.
Recent changes
Reward and scope changes across every Unity Technologies program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Unity Technologies products, from the NVD.
-
CVE-2025-59489 High
Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that applica
-
CVE-2023-37250 High
Unity Parsec has a TOCTOU race condition that permits local attackers to escalate privileges to SYSTEM if Parsec was installed in "Per User" mode. The application intentionally launches DLLs from a user-owned directory but intended to always perform integrity verification of those DLLs. This affects Parsec Loader versions through 8. Parsec Loader 9 is a fixed version.
-
CVE-2015-9288 Medium
The Unity Web Player plugin before 4.6.6f2 and 5.x before 5.0.3f2 allows attackers to read messages or access online services via a victim's credentials
About this page
This page gathers every public program listed under unity.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.