Public bug bountyLaunched Sep 2025 · Updated 2 months ago

Vertex Gaming

Cloud game streaming & player accounts · vertex.gg

Accepting reports
Public
Managed triage
Safe harbour

Your access

Open to every researcher

Submit a report Read the rules of engagement first

Max bounty: $9,000
Avg. response: 1.5 days
Reports resolved: 260
Bounties paid: $402k
Researchers: 88

Overview

Vertex Gaming streams games from its own cloud, so both the player-facing platform and the session infrastructure behind it are in scope. Cheat development is not — we are looking for security bugs, not gameplay exploits.

Program terms

Type: Public
Rewards: Bounty · USD
Triage: Managed
Disclosure: Coordinated
Safe harbour: Offered
Status: Active

Response targets

First response: 2 days
Triage decision: 4 days
Resolution: 30 days
Avg. first response: 1.5 days

Scope

4 in · 4 out

In scope

In-scope assets
Asset	Type	Environment
play.vertex.gg	Web	Production
Session orchestration API	API	Production
Player account service	API	Production
Vertex desktop client	Desktop	Production

Out of scope

Out-of-scope assets and activities
Asset or activity	Reason
Community forums	—
In-game balance & gameplay exploits	—
Denial-of-service / volumetric	—
Third-party publisher titles	—

Not rewarded

Denial of service / volumetric attacks
Self-XSS requiring victim-side paste
Missing security headers without demonstrated impact
Rate-limit or user enumeration without demonstrated impact
SPF / DKIM / DMARC configuration
Social engineering of staff or users
Best-practice reports with no security consequence

Rewards

USD · per valid finding

Rewards by severity
Severity	Bounty
CriticalRCE, auth bypass, mass data exposure	$9,000from $3,600
HighSSRF, stored XSS, privilege escalation	$3,400from $1,400
MediumIDOR, CSRF on sensitive actions	$850from $340
LowReflected XSS, minor info disclosure	$170from $70

Final severity is set by Zerohunt triage.Ranges are per valid, in-scope finding.

Rules of engagement

5 rules

Test only assets listed in scope. Never access, modify or delete data that does not belong to your test account.
Use your own test accounts. Stop immediately if you encounter another user's data and report it.
No denial-of-service, automated scanning at scale, or social engineering of staff or users.
Report each vulnerability once, with clear reproduction steps and evidence. Duplicates are closed against the earliest valid report.
Keep findings confidential until Vertex confirms a fix and agrees to disclosure. Good-faith research is authorized and will not be pursued legally.

Testing requirements

Use the test accounts issued to you. Tag automated traffic with a `X-Bug-Bounty: <your-handle>` header and keep request rates below 5/s.

Authorization

Testing is authorized only within the scope and rules on this page. Findings outside scope are not eligible and may not be protected under safe harbour.

Disclosure & safe harbour

Disclosure policy

Coordinated

Vertex Gaming agrees a publication date with you once the issue is resolved.

Safe harbour

Offered

Vertex Gaming will not pursue legal action against good-faith research within these rules.

Safe harbour statement

Vertex will not pursue civil or criminal action, or send notice to law enforcement, for accidental or good-faith violations of this policy. We consider research conducted under it to be authorized, lawful and helpful to the overall security of the internet. You remain responsible for complying with any other applicable laws.

Recent activity

Latest 4

MediumCSRF on account email changeNeeds info
CriticalContainer escape from a streaming sessionResolved · $9,000
HighEntitlement check missing on library importResolved · $3,375
LowPlayer email disclosed in match metadataResolved · $170

Ready to report

Found something on Vertex Gaming?

Submit a structured report with steps and evidence. Managed triage reviews it, and a valid finding is rewarded by severity.

Submit a report All programs