Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Epic Games VDP

By Epic Games Vulnerability disclosure program on HackerOne epicgames.com

Accepting reports
Go to program Website
Top reward
No cash rewards
Top severity paid
Critical
Assets in scope
88
Public CVEs
4
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report on HackerOne
Submit through the program page.
Replies within 5 days
As the policy promises.
Publish after a fix
Coordinate the timing with the company.

Rewards

What HackerOne lists as the payout for each severity.

This program does not pay cash rewards.

Pays cash
No This is a vulnerability disclosure program. This program offers neither bounties nor swag.
Response
Within 5 days | First Response | 5 business days |

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

88 assets you may test, 8 excluded.

Wildcard domains 31

  • *.3lateral.com Critical No bounty
  • *.amplitude-game.com Critical No bounty
  • *.artstation.com Critical No bounty
  • *.audicagame.com Critical No bounty
  • *.bcbits.com Critical No bounty
  • *.cubicmotion.com Critical No bounty
  • *.dancecentral.com Critical No bounty
  • *.dropmix.com Critical No bounty
  • *.easy.ac Critical No bounty
  • *.epicgames.com Critical No bounty
  • *.epicgames.dev Critical No bounty
  • *.fallguys.com Critical No bounty
  • *.fortnite.com Critical No bounty
  • *.harmonixmusic.com Critical No bounty
  • *.hmxservices.com Critical No bounty
  • *.hmxwebservices.com Critical No bounty
  • *.hostman.prod.adad.live.use1a.on.epicgames.com Critical No bounty
  • *.jellychat.com Critical No bounty
  • *.mediatonic.co.uk Critical No bounty
  • *.oncatapult.com Critical No bounty
  • *.psynet.gg Critical No bounty
  • *.psyonix.com Critical No bounty
  • *.quixel.com Critical No bounty
  • *.rockbandvr.com Critical No bounty
  • *.rocketleague.com Critical No bounty
  • *.singspacegame.com Critical No bounty
  • *.sketchfab.com Critical No bounty
  • *.superbeatsports.com Critical No bounty
  • *.twinmotion.com Critical No bounty
  • *.unrealengine.com Critical No bounty
  • *.unrealtournament.com Critical No bounty

Desktop and binaries 14

  • EOS C# SDK Critical No bounty
  • EpicGamesLauncher.exe Critical No bounty
  • Fallguys Game Critical No bounty
  • FortniteClient-Mac-Shipping.app Critical No bounty
  • FortniteClient-Win64-Shipping_BE.exe Critical No bounty
  • FortniteClient-Win64-Shipping_EAC.exe Critical No bounty
  • FortniteClient-Win64-Shipping.exe Critical No bounty
  • FortniteLauncher.exe Critical No bounty
  • FortniteLauncher-Win64-Shipping_BE.exe Critical No bounty
  • FortniteLauncher-Win64-Shipping_EAC.exe Critical No bounty
  • FortniteLauncher-Win64-Shipping.exe Critical No bounty
  • UEFN Critical No bounty
  • UnrealEditorFortnite.exe Critical No bounty
  • UnrealEditorFortnite-Win64-Shipping.exe Critical No bounty

Web 13

  • admin-dev.harmonixmusic.com Critical No bounty
  • admin.harmonixmusic.com Critical No bounty
  • answers.unrealengine.com Critical No bounty
  • api.epicgames.dev Critical No bounty
  • aqtooling.com Critical No bounty
  • aquiris.com.br Low No bounty
  • aquiris.studio Low No bounty
  • aquiristech.com Critical No bounty
  • artportal.epicgames.com Critical No bounty
  • audica-live-admin.hmxwebservices.com Critical No bounty
  • audica-prod-admin.hmxwebservices.com Critical No bounty
  • audica-prod-api.hmxwebservices.com Critical No bounty
  • autodiscover.harmonixmusic.com Critical No bounty

iOS apps 2

  • apple.co/-HorizonChase2 Informational No bounty
  • app.playwonderbox.com Informational No bounty

Source code 2

  • EOS SDK Critical No bounty
  • EpicGames/UnrealEngine_v5.2 Critical No bounty

Android apps 1

  • FortniteClient-Android-Shipping-arm64-es2.apk Critical No bounty

Products and areas 25

  • Adobe Flash related submissions Critical No bounty
  • Any other Epic games owned asset not listed in the out of scope section Critical No bounty
  • Artstation marketplace Critical No bounty
  • Compass POST ​/compass​/v1​/namespace​/fortnite​/new_island_offer_report Critical No bounty
  • Compass POST ​/compass​/v1​/namespace​/fortnite​/new_island_purchase_report Critical No bounty
  • Easy Anti-Cheat Bypasses Informational No bounty
  • EpicOnlineServices Critical No bounty
  • Fortnite cheats Informational No bounty
  • Fortnite In-Island Transactions Critical No bounty
  • Fortnite Mobile app Informational No bounty
  • In-Island purchase report form from account management Critical No bounty
  • In-Island Transaction Offer Report Flow Critical No bounty
  • KWS Informational No bounty
  • Miscellaneous Research Critical No bounty
  • Other Fortnite Assets Critical No bounty
  • Player Support Chatbot Critical No bounty
  • Recent Acquisitions Informational No bounty
  • Sketchfab ripping" 3D model / mesh / texture / etc. content out of the 3D web viewer Critical No bounty
  • Sketchfab Store (paid asset marketplace) Critical No bounty
  • Third-party games or apps distributed through the mobile stores Informational No bounty
  • Third-party services not managed by Epicgames Informational No bounty
  • Twinmotion Informational No bounty
  • UnrealEngine Informational No bounty
  • Verse Coding language Critical No bounty
  • Web Shops Critical No bounty
Out of scope (8)
  • Popjam Android application
  • Rukkaz Android application
  • *.bandcamp.com
  • *.corp.bandcamp.com
  • *.popjam.com
  • *.rukkaz.com
  • *.superawesome.com
  • *.superawesome.tv

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Epic Games VDP (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • Please only use an account you own that has been created for security testing when demonstrating a vulnerability. Your test account must include the phrase "sectest" in the username.
  • Do not maliciously exploit any vulnerabilities.
  • Avoid accessing any private or confidential information pertaining to Epic, our users, and/or any third parties.
  • Where applicable, you should use the following custom HTTP header during testing: `X-Bug-Bounty: Hackerone-<username>`
  • Please provide detailed reports with reproducible steps. Reports which are not detailed enough to reproduce may be closed as NA.
  • Please only submit one vulnerability per report unless multiple vulnerabilities are required to provide an impact.
  • Testing of vulnerabilities like cheats or exploits must be done using minimal proofs of concept and without disrupting gameplay for other users.
  • When testing vulnerabilities in community-driven material, like forums or profiles, you may only test on content you've created.
  • You may not use any Epic created content (such as Megascans) when performing testing on any of our digital marketplace products (such as Fab).
  • In case any potentially harmful action is required to test or validate a vulnerability or bug, submit your potential finding and ask for permission prior to taking the potentially harmful action.

Not accepted

  • Vulnerabilities from automated scanners without additional analysis
  • Vulnerabilities relying on out of date browsers/software
  • Denial of Service
  • Distributed Denial of Service attacks
  • Social Engineering
  • Physical attempts against Epic Games offices/property
  • Clickjacking/UI-redressing
  • XSS only affecting old browser versions
  • Missing or misconfigured security-related HTTP headers that do not directly lead to a vulnerability
  • Mixed content warnings
  • Missing cookie flags that do not directly lead to a vulnerability
  • All types of brute-force and/or credential stuffing attacks (with the exception of faulty or missed rate-limiting)
  • Credentials to individual end-user accounts (e.g. Epic Games Store accounts)
  • Fortnite UEFN Live Edit Session Crashes are considered out of scope
  • Social engineering (e.g. phishing, vishing, smishing) attacks
  • Physical security attacks
  • SPF, DKIM, and DMARC records and flags
  • Text-only injection
  • Password stuffing attacks
  • Bugs/Attacks requiring extremely unlikely actions by a victim (e.g. Self-XSS)
  • Adobe Flash related submissions
  • Assets not owned by Epic Games (third party assets)

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 43 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD
CVESeverityPublished
CVE-2024-11872 High 7.8 12 Dec 2024
CVE-2018-17707 High 8.8 24 Jan 2019
CVE-2010-2702 High 9.3 12 Jul 2010
CVE-2008-6441 High 9.3 9 Mar 2009

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Note: ==This is a vulnerability disclosure program. This program offers neither bounties nor swag. If you are looking for the Epic Games bug bounty program you can find it here==.

The Epic Games VDP is offered in order to coordinate the responsible disclosure of vulnerabilities for researchers or firms who are not seeking bounties. If you believe you have discovered a security issue in our products, services, or anything else related to Epic Games then please report it as soon as possible so we can investigate and coordinate on any planned disclosure.

==This program is for the responsible disclosure of vulnerabilities, most commonly used by security research firms. If you are seeking a bounty please use our bug bounty program==

Response Targets

Epic Games VDP will make a best effort to meet the following SLAs for hackers participating in our program:

Type of Response SLA in business days
First Response 5 business days
Time to Triage 10 business days

The Epic Games team will do our best to keep you informed about our progress throughout the process.

Disclosure Policy

  • Please do not publicly disclose findings without first coordinating with Epic Games
  • Follow HackerOne's disclosure guidelines.

Program Rules

###General Guidelines

  • This program will not reverse bans on accounts. Please only use an account you own that has been created for security testing when demonstrating a vulnerability. Your test account must include the phrase "sectest" in the username.
  • Do not maliciously exploit any vulnerabilities.
  • Avoid accessing any private or confidential information pertaining to Epic, our users, and/or any third parties.
  • Where applicable, you should use the following custom HTTP header during testing: X-Bug-Bounty: Hackerone-<username> to differentiate your requests from those from normal users. Example: X-Bug-Bounty: Hackerone-FlyingToasters. Additional custom headers may be added to differentiate between tests or reports.
  • Whenever possible, your reports should include as much information as possible regarding your tests and environment. For example: AccountID, IP, SessionID, Client Version, Client Log File, Date and Time, etc.
  • When reporting vulnerabilities, please consider (1) attack scenario/exploitability, and (2) security impact of the bug. These are crucial when determining the severity of your finding.
  • Please provide detailed reports with reproducible steps. Reports which are not detailed enough to reproduce may be closed as NA.
  • Please only submit one vulnerability per report unless multiple vulnerabilities are required to provide an impact.
  • Testing of vulnerabilities like cheats or exploits must be done using minimal proofs of concept and without disrupting gameplay for other users.
  • When testing vulnerabilities in community-driven material, like forums or profiles, you may only test on content you've created. Do not attempt to discover findings on any community content other than your own. Where possible, delete any comments/posts after confirmation of findings so as not to pollute pages.
  • You may not use any Epic created content (such as Megascans) when performing testing on any of our digital marketplace products (such as Fab).
  • When testing for findings, please do not flood email forms, public forums, publish insensitive or illegal content, or any other publicly consumable content in a way that may have an adverse effect on user experience.
  • Any content obtained during the POC of a finding must be deleted from systems within your control upon notice of your finding being rejected or validated by Epic.
  • In case any potentially harmful action is required to test or validate a vulnerability or bug, submit your potential finding and ask for permission prior to taking the potentially harmful action. Do not take any potentially harmful actions without the explicit permission of the Epic Games team.

Out of Scope

  • Vulnerabilities from automated scanners without additional analysis
  • Vulnerabilities relying on out of date browsers/software
  • Denial of Service
  • Distributed Denial of Service attacks
  • Social Engineering
  • Physical attempts against Epic Games offices/property
  • Clickjacking/UI-redressing
  • XSS only affecting old browser versions
  • Missing or misconfigured security-related HTTP headers that do not directly lead to a vulnerability
  • Mixed content warnings
  • Missing cookie flags that do not directly lead to a vulnerability
  • All types of brute-force and/or credential stuffing attacks (with the exception of faulty or missed rate-limiting)
  • Credentials to individual end-user accounts (e.g. Epic Games Store accounts)
  • Fortnite UEFN Live Edit Session Crashes are considered out of scope
  • Social engineering (e.g. phishing, vishing, smishing) attacks
  • Physical security attacks
  • SPF, DKIM, and DMARC records and flags
  • Text-only injection
  • Password stuffing attacks
  • Bugs/Attacks requiring extremely unlikely actions by a victim (e.g. Self-XSS)
  • Adobe Flash related submissions
  • Assets not owned by Epic Games (third party assets)
    • If your finding is found to rely on a third party then it will be transferred to the corresponding VDP (if present).

Legal Notice

You grant Epic the right to freely use and disclose any feedback or suggestions that you provide through the Epic Games VDP, for any purpose, commercial or otherwise, without compensation to you, including to develop, copy, publish, modify, or improve Epic’s assets in our sole discretion.

Epic reserves the right to modify or terminate the Epic Games VDP in its sole discretion, at any time without prior notice.