The Bug Bounty programme

The security of player accounts and data matters more to us than shipping speed. But you cannot see everything from the inside: some holes are found from outside, by people who look at the service differently than we do. This programme is for them.

The point is simple: get the vulnerability from a researcher before someone uses it against our players. We pay for the find and we do not go after the person who brought it.

Where to write

Read the whole page before sending a report: it sets out the scope, what a report needs, and what earns nothing. That saves your time as much as ours.

Reports and questions about the programme go to [email protected]. If the find is confirmed and fits the terms, we take it on and keep you posted on what is happening.

Terms of participation

• All programme messages go to [email protected] and nowhere else. A report posted in a public Discord channel or a game ticket still reaches us — but only after outsiders have read it.
• You pass the vulnerability to us and do not publish it until we have had a reasonable time to fix it. Reasonable means as long as the fix takes: we name the timeline in our reply and tell you when it is done.
• There is no limit on how many reports one person may send.

Rules for safe testing

• Test only on your own accounts.
• Do not enter or use other people’s accounts without the explicit consent of the owner.
• Do nothing that could expose, alter or destroy other people’s data.
• Do not take services down or degrade them. Denial of service is not research, it is breakage.
• Stop as soon as the vulnerability is confirmed: you already have your proof, there is no need to go further.

Duplicate reports

• The reward goes to the first credible report of a vulnerability.
• If several reports arrive, the time the e-mail was received decides.
• We read duplicates but do not pay for them.
• A report that adds something new to a known issue — another route to exploit it, or heavier consequences — may earn a partial reward, at our discretion.
• If your report turns out to be a duplicate, we will say so plainly.

What to put in the report

The sharper the report, the faster we can verify and fix it. Here is what verification stalls without.

• How to reach you — a name or nickname and an e-mail address.
• The class of vulnerability and what it affects — XSS, SQL injection, an authorisation bypass, access to someone else’s object by id, and exactly where it shows up.
• A technical description — what is wrong and, if you worked it out, why. Write it for an engineer: precision beats polish.
• Where exactly — page address, API route, port, file path.
• Steps to reproduce — numbered, in order. This is the most important part of the report.
• Proof — a screenshot, a video or a short piece of code showing the vulnerability works.
• Impact — what an attacker gets out of it.
• A suggested fix — if you have one, we would like to hear it. Not required.

If you run into someone else’s data

Stop right there. Do not read on, do not save it, do not copy it, do not pass it to anyone. Delete whatever landed on your machine and say so in the report: what you saw and what you deleted. How much you looked at affects how we judge good faith — in your favour if you stopped at the first sign.

What is in scope

• The site achilora.com and everything it serves.
• The launcher and the mechanism that updates builds.
• Sign-in — authorisation on the site, in the launcher and in game: one account for all of it.
• Game servers — in the part that touches security: access to another account, to the console, to files.
• Public APIs — accounts, the shop, balance top-ups, game services.
• Integrations — on our side of them: taking payment and sending mail.

What earns no reward

The following is either out of scope or not grounds for a payout.

• DoS and DDoS, password guessing, spam, social engineering against the team or players.
• Reports with no demonstrated harm: missing "recommended" headers, SPF, DKIM and DMARC settings, account or address enumeration, missing rate limits.
• Clickjacking on pages with no sensitive action, and request forgery on actions that change nothing — signing out, for instance.
• Vulnerabilities in third-party libraries with no working proof against our service.
• Self-exploitation — anything only the victim can trigger against themselves.
• Game bugs, dupes and cheats with no security consequence. They are not wasted: they are paid for on the support page, it is simply a different conversation.
• Game balance questions and bugs in third-party mods.
• Anything that needs physical access to a device, or an account handed over willingly.
• Findings in other people’s services — Tebex, Discord, Cloudflare and the rest. Report those to them; they run their own programmes.

Severity and reward

The heavier the consequences, the larger the payout. The ceiling is 10,000 for a critical vulnerability; we name the exact figure in our reply to the report, before the fix.

• Critical — running your code on our servers, access to the database, a mass leak of player data.
• High — taking over another account, getting around payment, script injection on the sign-in or payment pages.
• Medium — limited access to other people’s data, request forgery on a non-critical action.
• Low — anything that grants no real advantage and exposes nothing of other people’s.

Protection for the researcher

We treat research as good faith when it is lawful, aimed at improving security rather than causing harm, and follows the rules on this page.

For research like that we will not sue you, report you to the police, seek damages, or ban your account for the act of testing itself. Our terms of use do not apply here — precisely as far as they would stand in the way of research under this policy.

This is not a free pass: you are still bound by the law, and the decision on whether research was in good faith stays with us. If you are unsure whether your method falls under this policy, ask at [email protected] before you try it.

Notes on payouts

• The reward is paid in the project currency — donate coins credited to your account. We do not pay money.
• We may change the terms of the programme, but changes are not retroactive: a report already sent is judged by the rules in force when it was sent.
• The project team and people close to them do not take part in the programme.