Immutable Bug Bounty

At a glance#

• Maximum payout: $10,000
• Public disclosure: Not allowed
• Managed by the platform: Yes
• Safe harbour: Full

In scope#

• https://passport.immutable.com/
• https://auth.immutable.com
• https://github.com/immutable/ts-immutable-sdk/tree/main/packages/passport/
• https://hub.immutable.com/
• https://play.immutable.com
• https://api.immutable.com
• https://api.x.immutable.com/

Out of scope#

• *.godsunchained.com
• *.gogbackend.com
• gogbackend.com
• godsunchained.com
• Anything that does not belong to Immutable
• Any data exposure bug that are classified as Public Data such as Ethereum Wallet Address, NFT Purchase activity, or othe...
• *.dev.x.immutable.com, *.sandbox.x.immutable.com, *.dev.x.immutable.com, *.sandbox.imtbl.com, *.dev.imtbl.com, *.ropsten...
• *.guildofguardians.com

Imported from the public directory. Always confirm scope on the official program page before testing.