Aghanim
Bug bounty on security.txt aghanim.com
- Top reward
- $1,250
- Top severity paid
- Critical
- Assets in scope
- 23
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $1,250
- for critical bugs, from $50.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 3 days
- As the policy promises.
- Paid by PayPal, bank transfer
- Proof of identity needed to get paid.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$1,250 |
| High |
|
$550 |
| Medium |
|
$250 |
| Low |
|
$50 |
- Top reward
-
$1,250
Critical │ Remote code execution, account takeover │ $1250
- Lowest reward
-
$50
Low │ Information disclosure │ $50
- Response
-
Within 3 days
We aim to acknowledge receipt within 3 business days and provide an initial triage assessment within 10 business days .
- Safe harbor
-
Full
If you make a good faith effort to comply with this policy, we consider your research to be authorized.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
23 assets you may test, 4 excluded.
Domains 20
- aghanim.app
- aghanim.com
- api.aghanim.com
- api.aghanim.store
- dashboard.aghanim.com
- dashboard-api.aghanim.com
- events.aghanim.com
- events-web.aghanim.com
- hub-api.aghanim.com
- hub-api.aghanim.store
- hub-api-global.aghanim.com
- my.aghanim.com
- my-api.aghanim.com
- my-api.aghanim.store
- pay.aghanim.com
- pay-api.aghanim.com
- pay-api.aghanim.store
- s2s-api.aghanim.com
- sdk-api.aghanim.com
- upload.aghanim.com
Android apps 1
- Aghanim Android SDK
Wildcard domains 1
- *.aghanim.app
Products and areas 1
- Aghanim Unity SDK
Out of scope (4)
- Third-party services, libraries, or integrations not owned by Aghanim (e.g. payment providers, analytics SDKs, OAuth providers)
- Vulnerabilities in a game integrator's own backend, code, infrastructure, or implementation are out of scope unless they compromise Aghanim's platform security boundaries
- Vulnerabilities that depend on outdated browsers, operating systems, or end-user malware
- Vulnerabilities that require a rooted, jailbroken, or otherwise compromised device, unless the issue results in compromise of other users, backend systems, or sensitive platform data
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Aghanim's policy. "We" in these lines means the program, not this site.
While testing
-
Only access data that belongs to you or test accounts
-
Not modify, destroy, or exfiltrate user data
-
Avoid disrupting our services or degrading performance
-
Immediately stop testing and report if sensitive data is exposed
-
Not access additional systems, accounts, or data beyond what is minimally necessary to demonstrate the vulnerability
-
Use test accounts. Create your own accounts for testing. Do not interact with accounts, games, or data that belong to other users.
-
Include the header X-Bug-Bounty: <your-email> in requests so we can distinguish research from real attacks during incident review.
-
Avoid high-volume automated scanning or fuzzing that may impact service availability or performance.
-
Demonstrate the vulnerability with the minimum necessary impact. Do not pivot, escalate, persist, or move laterally beyond what is required to prove the issue.
-
Do not perform actions that create real charges, send real notifications to other users, or alter shared data.
Not accepted
-
Denial of Service (DoS/DDoS), traffic floods, resource exhaustion
-
Social engineering of Aghanim staff, customers, or partners (e.g. phishing, impersonation, vishing)
-
Physical attacks against offices, data centers, or hardware
-
Brute-force or credential-stuffing attacks against authentication endpoints
-
Email or SMS flooding, including abuse of password-reset or verification flows
-
Aggressive automated scanning that degrades service performance
-
Missing security headers (CSP, HSTS, X-Frame-Options, etc.) without a demonstrated exploit
-
Missing rate limits on non-authentication endpoints without demonstrated harm
-
DNS records (SPF, DKIM, DMARC) or SSL/TLS configuration issues without material impact
-
Disclosure of public information, software versions, banners, or stack traces without leveraged impact
-
Clickjacking on pages without sensitive state-changing actions
-
CSRF on logout, login, or other non-sensitive actions
-
Self-XSS (requires victim to paste payload into their own browser)
-
Open redirects on non-sensitive paths
-
Account or email enumeration without further material impact
-
Tabnabbing on pages without authenticated state
-
Reports based solely on automated-scanner output, without a working proof of concept
-
Reports presenting purely theoretical impact without a realistic exploitation scenario
-
Vulnerabilities that depend on guessing or enumerating resource identifiers (e.g. order IDs, user IDs, etc)
-
Bypassing plan tiers, feature gates, or trial limits without compromising another customer's data or funds
-
Test-mode payment behavior that does not affect live mode
-
Issues that require a malicious game integrator acting against their own players
-
Fraud scenarios that require stolen payment methods, compromised third-party accounts, or social engineering of other users
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 2 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.