Gameforge AG
Vulnerability disclosure program on security.txt gameforge.com
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 6
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Safe harbor
-
Full
As long as you follow the rules below, you will not face legal action for responsible testing and disclosure.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
6 assets you may test.
Domains 3
- gameforge.com
- gameforge.de
- gfsrv.net
Wildcard domains 3
- *.gameforge.com
- *.gameforge.de
- *.gfsrv.net
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Gameforge AG's policy. "We" in these lines means the program, not this site.
While testing
-
You must not attack, exploit, alter, or otherwise compromise the accounts of third parties (players, employees, etc.). Where possible, only use your own accounts for testing.
-
DDoS, spam, or other disruptive attacks on our infrastructure are strictly prohibited, including social engineering and phishing.
-
Vulnerabilities must not be exploited for personal gain or to the detriment of third parties.
-
Vulnerabilities must be reported exclusively to Gameforge directly or via Bugcrowd and must not be disclosed publicly or to third parties before we have fixed them.
-
The use of automated scanners or large-scale automated testing tools is not permitted.
-
Social engineering of Gameforge staff or game teams is not allowed.
-
Only the websites and services explicitly listed as part of the program may be tested.
-
Gameforge should have sufficient time to react and fix the problem.
-
Whilst performing the security check, you have taken all necessary precautions not to interrupt or restrict the tested service’s availability.
-
You have not extracted or transmitted third-party data.
Not accepted
-
Issues that only affect obsolete or unsupported browsers or plug-ins
-
Vulnerabilities that require extremely unlikely or unrealistic user behavior (e.g. manual copy & paste, deliberate deactivation of security features)
-
Insecure cookie settings for cookies that do not contain confidential or sensitive data
-
Disclosure of information that presents no meaningful risk or is already publicly accessible
-
Vulnerabilities in third-party software or services used by Gameforge
-
Vulnerabilities in applications or domains not listed as part of the Gameforge Vulnerability Disclosure Program
-
Attacks requiring physical access to a user's device
-
Self-XSS (we require evidence on how the XSS can be used to attack another Gameforge user)
-
Issues without clearly identified security impact, such as clickjacking on a static website, missing security headers, or descriptive error messages
-
Lack of CSRF tokens (unless there is evidence of actual, sensitive user action not protected by a token)
-
Login/Logout CSRF
-
Our policies on presence/absence-content of SPF, DKIM, MTA-STS, and DMARC records
-
Host header injections unless you can show how they can lead to stealing user data
-
Absence of rate limiting, unless related to authentication
-
Missing security headers which do not lead directly to a vulnerability
-
Vulnerabilities only affecting users of outdated or unpatched browsers and platforms
-
Password, email and account policies, such as email id verification, reset link expiration, password complexity
-
Use of a known-vulnerable library (without evidence of exploitability)
-
Reports from automated tools or scans
-
Reports of insecure SSL/TLS ciphers (unless you have a working proof of concept, and not just a report from a scanner)
-
Any report about DLL hijacking without demonstrating how it gains new privileges is also out of scope
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 3 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.