- Top reward
- $3,000
- Top severity paid
- Critical
- Assets in scope
- 9
- Public CVEs
- 3
- Last change
At a glance
What to know before you start testing.
- Pays up to $3,000
- for critical bugs, from $100.
- Report on Bugcrowd
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Bugcrowd lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$3,000 from $2,000 |
| High |
|
$1,200 from $750 |
| Medium |
|
$500 from $250 |
| Low |
|
$200 from $100 |
- Safe harbor
-
Full
Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Earlier reward tables (1)
- 11 Nov 2026 to 11 Nov 2026: Critical up to $3,000
Scope
9 assets you may test.
Web 4
- https://cloud.unity.com
- https://id.unity.com
- https://pay.unity.com
- https://store.unity.com
APIs 2
- https://api.unity.com
- https://services.unity.com
Products and areas 3
- https://unity3d.com/get-unity/download/archive
- https://unity.com/download
- player-login.unity.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Unity Technologies (via Bugcrowd)'s policy. "We" in these lines means the program, not this site.
While testing
-
Refrain from any disclosure to the public or a third-party before resolution of the issue.
-
Make a good faith effort to avoid privacy violations, destruction/modification of data, and interruption or degradation of our service.
-
Only interact with accounts you own or with explicit permission of the account holder.
-
If you have compromised a Unity server you will not use it for further chained attacks.
-
Clean up after your tests.
-
Testing is only authorized on the targets listed as in scope.
Not accepted
-
Subdomain takeovers
-
Denial of service
-
Rate limiting issues
-
Spamming
-
Email spoofing
-
Self-XSS and issues exploitable only through self-XSS
-
window.opener -related issues.
-
SSL/TLS related configuration issues (aka no SSL labs reports)
-
Cookie security issues for non-session cookies
-
HTTP header security
-
Defense in-depth issues
-
Login/Logout CSRF
-
Automated tool reports
-
Presence of autocomplete on web forms
-
Attacks only exploitable on older browsers or browsers with non-default configurations
-
Open redirects - unless they can be used for actively stealing tokens
-
Reports stating software is out of date or vulnerable without a proof of concept
-
Best practice concerns without a demonstration of practical exploitability
-
Contact and support forms
-
HTML injection that doesn't lead to XSS
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 22 seconds ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
https://unity.com/download
-
Scope added
https://services.unity.com
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2025-59489 | Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that applica | High 7.4 | 3 Oct 2025 |
| CVE-2023-37250 | Unity Parsec has a TOCTOU race condition that permits local attackers to escalate privileges to SYSTEM if Parsec was installed in "Per User" mode. The application intentionally launches DLLs from a user-owned directory but intended to always perform integrity verification of those DLLs. This affects Parsec Loader versions through 8. Parsec Loader 9 is a fixed version. | High 7.0 | 20 Aug 2023 |
| CVE-2015-9288 | The Unity Web Player plugin before 4.6.6f2 and 5.x before 5.0.3f2 allows attackers to read messages or access online services via a victim's credentials | Medium 6.5 | 29 Jul 2019 |
Original policy
Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
Unity Technologies is committed to helping game developers build games easily and in a secure fashion. As part of this we encourage security researchers to test our security and find the things we miss. We look forward to seeing what you find! What we expect from you Send us a full, detailed report (discussed below) as soon as possible upon discovery of a potential security issue Refrain from any disclosure to the public or a third-party before resolution of the issue. Make a good faith effort to avoid privacy violations, destruction/modification of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder. If you have compromised a Unity server you will not use it for further chained attacks. Clean up after your tests. Both automated and manual tests can leave a number of dummy and spam entries, so we ask you to do your best to remove them after you're finished. By sending us a report or otherwise participating in our bug bounty program, you agree that you have read and understood this policy and agree to all its terms. What you can expect from us We will respond to your bug report as quickly as we can. We will keep you updated on the progress of getting the issue fixed. Reward decisions are made once a week. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.
Targets
Testing is only authorized on the targets listed as in scope. Any domain/property of Unity not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Unity, you can report it here. However, be aware that it is ineligible for rewards or points-based compensation. Target Information: Unity is a cross-platform game engine that welcomes you to test for vulnerabilities in their application. For testing you can self register for an account using your @bugcrowdninja.com email address using the following link: https://store.unity.com/#plans-individual Excluded submission types Subdomain takeovers Denial of service Rate limiting issues Spamming Email spoofing Self-XSS and issues exploitable only through self-XSS window.opener -related issues. SSL/TLS related configuration issues (aka no SSL labs reports) Cookie security issues for non-session cookies HTTP header security Defense in-depth issues Login/Logout CSRF Automated tool reports Presence of autocomplete on web forms Attacks only exploitable on older browsers or browsers with non-default configurations Open redirects - unless they can be used for actively stealing tokens Reports stating software is out of date or vulnerable without a proof of concept Best practice concerns without a demonstration of practical exploitability Contact and support forms HTML injection that doesn't lead to XSS Out-of-Scope Social engineering (including phishing) of Unity staff or contractors Any physical attempts against Unity property or data centers Zero days for third party services Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.
Additional information
This bounty requires explicit permission to disclose the results of a submission.