Rec Room Video Games

Description

Important: Do not use vulnerability scanners on this program. Rec Room is the best place to build and play games together. Party up with friends from all around the world to chat, hang out, explore MILLIONS of player-created rooms, or build something new and amazing to share with us all. Rec Room is free, and cross plays on everything from phones to VR headsets. It’s the social app you play like a video game! No technology is perfect and Rec Room believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our targets. Good luck, and happy hunting! Support: For bugs/issues pertaining to in game experience (that don't pose a security impact), please refer to our Submitting an In-Game Bug Report support article. Changelog: New updates can be found here: https://recroom.com/ship-notes Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. In-game Items As a thanks for keeping Rec Room secure, we are also rewarding exclusive in-game items in addition to cash. Item Requirements Requirement │ Reward Submission was rewarded points │ Hackola 25 points earned total │ Hacker Suit (white) 50 points earned total │ Hacker Hat (white) All the items above require a Rec Room account to be received. For the Hacker Suit and Hacker Hat, we require you to share your Rec Room username in order for us to process the rewards. We reserve the right to not reward Rec Room items for submissions, based off of our discretion after review. Collaborator Points Bonus For any submission with collaborators, the points given will be doubled and capped at total number of points rewarded for the given priority. For example, Researcher A is getting 60%, and Researcher B is getting 40%. The submission is rewarded a total of 20 points. Researcher A gets 12 points, and Researcher B gets 8 points. With item rewards, we will count these points as 20 points for Researcher A, and 16 points for Researcher B. Please note that if you have collaborated, your total points in our program does not include our bonus.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of Rec Room not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Rec Room, you can report it to this program. However, be aware that it is ineligible for rewards or points-based compensation. Example vulnerabilities by priority level: Priority │ Example Vulnerability P1 │ Access to game servers to manipulate code or change back end data through any means, for example through our admin pages. P2 │ Access to developer/ moderator account, for example convert a non-moderator account to a moderator account. P3 │ Game exploits that can cause a game outage, for instance via packet manipulation, and game exploits that can be used to duplicate items or impact another player's experience in the game. P4 │ Modify values or duplicate a non-sellable item in the game on the user's local account. Anything that can affect the local user's play experience but doesn't impact other players. Target Information: The web app and API are both also in scope, but the primary target is the free cross-platform Rec Room game, which you will need to download to your device. There are many videos available of hacks and game exploits if you search for Rec Room game exploits on YouTube. Major issues should have been fixed right away, but if there is a valid rewardable bug we do not know about that you learn from a video, feel free to report it. Rec Room Games Services In Scope: Rec Room standalone app https://rec.net/download Steam https://store.steampowered.com/app/471710/Rec_Room/ Oculus Quest https://www.oculus.com/experiences/quest/2173678582678296 Oculus Rift https://www.oculus.com/experiences/rift/1257029974329451 Nintendo Switch https://www.nintendo.com/us/store/products/rec-room-switch/ iOS games at https://apps.apple.com/app/id1450306065 Android games at https://play.google.com/store/apps/details?id=com.AgainstGravity.RecRoom Xbox https://www.xbox.com/en-us/games/store/rec-room/9pgpqk0xthrz PlayStation 5 https://store.playstation.com/en-us/product/UP2662-PPSA05532_00-6681199027107223 PlayStation 4 https://store.playstation.com/en-us/product/UP2662-CUSA08481_00-RECROOM000000001 Rec Room Studio https://recroom.com/studio RecNet API Portal https://devportal.rec.net/ Documentation: Rec Room New User Guide: https://recroom.zendesk.com/hc/en-us/articles/4533930338199-New-User-Guide Rec Room on iOS: https://recroom.zendesk.com/hc/en-us/articles/4424680775575-Rec-Room-on-iOS Rec Room Discord server: https://discord.gg/recroom , the FAQ section has links to information on how to play and navigate around the game. Access: The targets are available on the public internet. Credentials: Important: Please sign up for an account with "Bugcrowd" as the first part of your username (ex: BugcrowdNinja, Bugcrowd_tester) to prevent the game moderators from accidentally banning you. After downloading the game, to gain access to the application please sign up for an account using your @bugcrowdninja.com email address and set up an avatar. For more info regarding @bugcrowdninja email addresses, see here . This account can also be used to log in on https://rec.net . Focus Areas: Issues that allow in-game currency to be improperly generated, stolen, or manipulated. Exploits and issues that disrupt game play for other users. Vulnerabilities that allow for Rec Room account takeover. Out-of-Scope Company email servers DoS / DDoS attacks Payment processing (handled by a third party) Do not use vulnerability scanners on this program Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.