Manticore Games Bug Bounty Program

Introduction

Manticore Games is committed to ensuring the highest security and data protection standards for our players and creators. As part of this effort, we invite the security community to test and identify any vulnerabilities in our systems through our Bug Bounty Program.

The Manticore Games Bug Bounty Program is designed to encourage the responsible reporting of potential security vulnerabilities. We recognize the valuable role that security researchers play in cybersecurity and appreciate your efforts to make our services safer.

To ensure everyone's safety and to foster a positive relationship with our developers, we ask that you:

• Share the security issue with us in a responsible manner.
• Do not access or modify user data without permission.
• Do not interrupt or degrade our services.
• Do not exploit any security issue found for any reason outside of the scope of this program.
• Act in good faith to avoid privacy violations, destruction of data, and service disruption.

How to Report

Email reports to security@manticoregames.com. See General Guidelines for what a report should include.

Scope of the Program

The Manticore Games Bug Bounty Program covers our websites, game client, and API endpoints. Specifically, this includes:

• The manticoregames.com domain
• The playharmony.ai domain
• The manticoreusercontent.com domain

The following are specifically excluded from the scope of the program:

• Vulnerabilities from automated scanners without additional analysis
• Vulnerabilities that rely on severely out of date browsers/software
• SPF, DKIM, and DMARC records and flags
• Attacks requiring extremely unlikely actions by a victim or that only affect yourself (e.g., Self-XSS)
• Distributed Denial of Service attacks
• Password, email and account policies, such as email ID verification, reset link expiration, password complexity
• Missing security headers which do not lead directly to a vulnerability
• Missing best practices (we require evidence of a security vulnerability)
• Social engineering (e.g., phishing, vishing, smishing) attacks
• Clickjacking
• User generated content unless there are demonstrable impacts beyond the content itself

Please note, third-party services, including any other service not explicitly owned and controlled by Manticore Games, Inc., are excluded from this program.

General Guidelines

Participants must:

• Be over the age of 18 to participate.
• Comply with all applicable laws and regulations.
• Not reside in or submit reports from countries under U.S. sanctions such as:
  • Afghanistan
  • Belarus
  • Burma
  • Central African Republic
  • Cuba
  • Democratic Republic of the Congo
  • Ethiopia
  • Iran
  • Iraq
  • Lebanon
  • Libya
  • Mali
  • North Korea
  • Russia
  • Somalia
  • South Sudan
  • Sudan (and Darfur)
  • Syria
  • Venezuela
  • Yemen
  • Zimbabwe

Researchers who identify potential vulnerabilities should include detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, it may not qualify for a reward. Include proof-of-concept code, screenshots, or any other relevant information that can help us understand the vulnerability.

Employees, or former employees that separated from the company within the prior 18 months, contingent workers, contractors and their personnel, or consultants of Manticore Games or its subsidiaries, as well as persons living in the same household and their immediate family members, are not eligible to receive bounties or rewards of any kind under the program.

Reward Structure

Our reward structure is based on the CVSS v3.1 scoring system. The following ranges represent the minimum and maximum reward for vulnerabilities of the corresponding severity:

Severity	CVSS v3.1 score	Reward
Critical	9.0 – 10.0	$1,550 – $5,000
High	7.0 – 8.9	$550 – $1,500
Medium	4.0 – 6.9	$250 – $500
Low	0.1 – 3.9	$100 – $200

Please note that these are guidelines, and final reward decisions are made at our sole discretion.

Legal Points

By participating in our Bug Bounty Program, you agree to our terms set forth herein and in our Terms of Service, including not to disclose the vulnerability to the public or any third party until we have addressed it. Any violation of these terms may result in disqualification from the program, forfeiture of the reward, and potential legal action.

We reserve the right to modify the terms or policies of our Bug Bounty Program at any time.