Vulnerability Disclosure Program (VDP)
VDPs are meant for responsibly reporting vulnerabilities you encounter — not for actively hunting for fame or reputation. Even if you're just starting out, consider focusing on rewarded bug bounty programs instead.
epicgames-vdp
91
In Scope
9
Out of Scope
In-Scope Assets (91)
| Asset | Category | Bounty | Quick Links | |
|---|---|---|---|---|
| *.3lateral.com | OTHER | No | - | |
| *.amplitude-game.com | OTHER | No | - | |
| *.artstation.com | OTHER | No | - | |
| *.audicagame.com | OTHER | No | - | |
| *.bcbits.com | OTHER | No | - | |
| *.bcbits.com | WILDCARD | No | ||
| *.cubicmotion.com | OTHER | No | - | |
| *.dancecentral.com | OTHER | No | - | |
| *.dropmix.com | OTHER | No | - | |
| *.easy.ac | OTHER | No | - | |
| *.epicgames.com | OTHER | No | - | |
| *.epicgames.dev | WILDCARD | No | ||
| *.epicgames.dev | OTHER | No | - | |
| *.fallguys.com | OTHER | No | - | |
| *.fallguys.com | WILDCARD | No | ||
| *.fortnite.com | OTHER | No | - | |
| *.harmonixmusic.com | OTHER | No | - | |
| *.hmxservices.com | OTHER | No | - | |
| *.hmxwebservices.com | OTHER | No | - | |
| *.hostman.prod.adad.live.use1a.on.epicgames.com | OTHER | No | - | |
| *.jellychat.com | OTHER | No | - | |
| *.mediatonic.co.uk | OTHER | No | - | |
| *.oncatapult.com | OTHER | No | - | |
| *.psynet.gg | OTHER | No | - | |
| *.psyonix.com | OTHER | No | - | |
| *.quixel.com | OTHER | No | - | |
| *.rockbandvr.com | OTHER | No | - | |
| *.rocketleague.com | OTHER | No | - | |
| *.singspacegame.com | OTHER | No | - | |
| *.sketchfab.com | OTHER | No | - | |
| *.superbeatsports.com | OTHER | No | - | |
| *.twinmotion.com | WILDCARD | No | ||
| *.unrealengine.com | OTHER | No | - | |
| *.unrealtournament.com | OTHER | No | - | |
| Adobe Flash related submissions | OTHER | No | - | |
| Any other Epic games owned asset not listed in the out of scope section | OTHER | No | - | |
| Artstation marketplace | OTHER | No | - | |
| Compass POST /compass/v1/namespace/fortnite/new_island_offer_report | OTHER | No | - | |
| Compass POST /compass/v1/namespace/fortnite/new_island_purchase_report | OTHER | No | - | |
| EOS C# SDK | BINARY | No | - | |
| EOS SDK | CODE | No | - | |
| Easy Anti-Cheat Bypasses | OTHER | No | - | |
| EpicGames/UnrealEngine_v5.2 | CODE | No | - | |
| EpicGamesLauncher.exe | BINARY | No | - | |
| EpicOnlineServices | OTHER | No | - | |
| Fallguys Game | BINARY | No | - | |
| Fortnite In-Island Transactions | OTHER | No | - | |
| Fortnite Mobile app | OTHER | No | - | |
| Fortnite cheats | OTHER | No | - | |
| FortniteClient-Android-Shipping-arm64-es2.apk | ANDROID | No | ||
| FortniteClient-Mac-Shipping.app | BINARY | No | - | |
| FortniteClient-Win64-Shipping.exe | BINARY | No | - | |
| FortniteClient-Win64-Shipping_BE.exe | BINARY | No | - | |
| FortniteClient-Win64-Shipping_EAC.exe | BINARY | No | - | |
| FortniteLauncher-Win64-Shipping.exe | BINARY | No | - | |
| FortniteLauncher-Win64-Shipping_BE.exe | BINARY | No | - | |
| FortniteLauncher-Win64-Shipping_EAC.exe | BINARY | No | - | |
| FortniteLauncher.exe | BINARY | No | - | |
| In-Island Transaction Offer Report Flow | OTHER | No | - | |
| In-Island purchase report form from account management | OTHER | No | - | |
| KWS | OTHER | No | - | |
| Miscellaneous Research | OTHER | No | - | |
| Other Fortnite Assets | OTHER | No | - | |
| Player Support Chatbot | AI | No | - | |
| Recent Acquisitions | OTHER | No | - | |
| Sketchfab Store (paid asset marketplace) | OTHER | No | - | |
| Sketchfab ripping" 3D model / mesh / texture / etc. content out of the 3D web viewer | OTHER | No | - | |
| Third-party games or apps distributed through the mobile stores | OTHER | No | - | |
| Third-party services not managed by Epicgames | OTHER | No | - | |
| Twinmotion | OTHER | No | - | |
| UEFN | BINARY | No | - | |
| UnrealEditorFortnite-Win64-Shipping.exe | BINARY | No | - | |
| UnrealEditorFortnite.exe | BINARY | No | - | |
| UnrealEngine | OTHER | No | - | |
| Verse Coding language | OTHER | No | - | |
| Web Shops | OTHER | No | - | |
| admin-dev.harmonixmusic.com | URL | No | ||
| admin.harmonixmusic.com | URL | No | ||
| answers.unrealengine.com | URL | No | ||
| api.epicgames.dev | URL | No | ||
| app.playwonderbox.com | IOS | No | - | |
| apple.co/-HorizonChase2 | IOS | No | - | |
| aqtooling.com | URL | No | ||
| aquiris.com.br | URL | No | ||
| aquiris.studio | URL | No | ||
| aquiristech.com | URL | No | ||
| artportal.epicgames.com | URL | No | ||
| audica-live-admin.hmxwebservices.com | URL | No | ||
| audica-prod-admin.hmxwebservices.com | URL | No | ||
| audica-prod-api.hmxwebservices.com | URL | No | ||
| autodiscover.harmonixmusic.com | URL | No |
Out-of-Scope Assets (9)
| Asset | Category | Bounty | |
|---|---|---|---|
| *.bandcamp.com | OTHER | No | |
| *.bandcamp.com | WILDCARD | No | |
| *.corp.bandcamp.com | OTHER | No | |
| *.popjam.com | OTHER | No | |
| *.rukkaz.com | OTHER | No | |
| *.superawesome.com | OTHER | No | |
| *.superawesome.tv | OTHER | No | |
| Popjam Android application | OTHER | No | |
| Rukkaz Android application | OTHER | No |