Hypixel Studios Managed Bug Bounty Engagement

Description

Welcome to Hypixel Studios Bug Bounty program! Founded in 2018, Hypixel Studios has been on a long journey to deliver their first game, Hytale. The studio mission is to apply years of collective experience in the modding and minigame server scenes to independent game development, providing community-empowering games that meet the needs of players and content creators alike. The security and privacy of our users are extremely important to us, separate to our own internal teams working on keeping you and your data safe this program enables players and the security research community to help us quickly repair security problems by reporting vulnerabilities. Ratings/Rewards For the initial prioritization/rating of findings, this engagement will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of Hypixel Studios not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Hypixel Studios, you can report it to this engagement. However, be aware that it is ineligible for rewards or points-based compensation. Engagement Guidelines Potential post-exploitation scenarios: If you believe you've identified a vulnerability that may lead to post-exploitation activity including modification or destruction of data please stop testing and submit your finding. We will work with you to evaluate the vulnerability and award you accordingly for the final impact and severity You are testing on a production enviroment. Behavior that compromises the stability and integrity of the target(s) is out of scope and will result in being banned from our program/platform. For example, do not target other users' data (use one of your other sets of credentials), delete/remove/edit parts of the site, engage any sort of DoS attack, and/or compromise any target's ability to function for other users. If you believe that you have found a vulnerability of this nature, please stop further testing and report it All testing must be done from your own accounts If you inadvertently encounter player data, do not view, alter, save, store, transfer, or otherwise access the data. Immediately purge any local information and notify us in your report Report Guidelines Vulnerabilities discovered on multiple paths, endpoints, parameters will be treated as duplicates. This includes findings across different environments (e.g., development, staging, production) unless the impact or exploitation method is materially different. Please submit only one report Reports must contain a clear explanation of the issue and the security impact along with detailed steps to reproduce it. If the issue cannot be reliably reproduced based on your report, it may be considered ineligible for a reward. Reports must contain: Clear description Location of vulnerability Reproduction Steps Screenshots of videos of you producing the vulnerability Impact Assessment Do not submit more than one vulnerability per report. In cases where demonstrating impact requires chaining multiple vulnerabilities together, those can be included in the same report as long as the linkage is clearly explained We do not accept reports that contain low-effort or AI-generated content. Submissions must demonstrate original analysis, clear understanding of the issue, and actionable detail. Reports lacking meaningful human analysis will be rejected Access All targets within scope are publicly accessible. Credentials To gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . Focus Areas To support your testing, we’ve highlighted several key areas of interest. While we ask that you report any efforts related to these areas, please note that testing is not limited to them. Submissions outside of these focus areas are equally welcomed and appreciated. N-day/Third party 0-day Policy When N-Day bugs are released to the public, please let us know. Each report will be reviewed on a case by case basis. Leaked Credentials Submissions related to leaked or exposed employee credentials (e.g., dark web forums, credential dumps) will be reviewed on a case-by-case basis and may qualify for points-based compensation only. The use of any leaked credentials during testing is strictly prohibited and may result in disqualification from the bounty program. Excluded Submission Types Low/No Impact Issues P5 vulnerabilities Reports that do not pose any security risk Missing security headers without demonstrated security impact Clickjacking on pages with no sensitive actions CSRF on logout or non-state-changing operations Availability & Volume-Based Attacks DoS/DDoS/Network DoS Rate limiting bypass attempts Email bombing or flooding Rate limiting or throttling issues Social Engineering & Credential Attacks ALL forms of social engineering Brute forcing or credential stuffing Account or email enumeration Game-Specific Exclusions Game exploits or cheats that do not affect server security Gameplay balance issues Bugs in user-generated content or mods User-generated content and mods Community-hosted game servers (unless the exploit lives within the base Hytale server) Third-Party & Out-of-Scope Platforms Tebex payment platform issues (report directly to Tebex) Tebex payment processing infrastructure Third-party services like Cloudflare and Google Cloud (report directly to the vendor) Vulnerabilities in third-party dependencies without a working proof of concept Other Exclusions Self-exploitation (vulnerabilities only exploitable by the victim) or requires remote unauthorized access to the target machine Email SPF, DKIM, and DMARC configuration issues Vulnerabilities requiring physical access to a device Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via our Freshdesk Portal before going any further.

In Scope (in scope)

Target Information Target │ Description All Hypixel Public APIs │ Auth, Accounts, Skins, Game Services, Store APIs Hytale Game Clients │ Desktop game clients Hytale Game Server │ Official server software and hosted servers Hytale Launcher (Go/Vue) │ Desktop launcher/patcher application accounts.hytale.com │ Authentication and account management store.hytale.com │ Store frontend (Tebex payments excluded) hytale.com │ Main website 3rd Party Integrations │ OAuth, social logins (Hytale-side issues only) arcanitegames.ca & hytale.dev │ Dev Environments