{"id":"3405453a-4ce4-4e30-ba62-ffa3af17807c","engagementId":"728e7246-caa8-45bc-b514-e969e7e53e93","data":{"brief":{"id":"820a1792-7958-4150-936f-fe385cf16913","name":"Entain Game Logic Flaws Bug Bounty Program","tagline":"Join the program and help us find game and business logic vulnerabilities in our Online Games and Sports Betting Games","description":"\u003cp\u003eWelcome to Entain's Game and Business Logic Flaw  bug bounty program! \u003cbr\u003e\nWe are Entain, an international sports betting and gambling company, and like our customers, we get excited about the world of sport, gaming and interactive entertainment. Whether it’s watching your favourite team, beating your mates or experiencing the next big thing, we love exciting moments. Just like hunting down your next big win in an 5 vs 5 team death match, you finding a flaw within our applications should bring some excitement to your and our lives.\u003c/p\u003e\n\n\u003cp\u003eGood luck, and happy hunting!\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003ePlease note the following:\u003c/em\u003e\u003c/strong\u003e\u003cbr\u003e\n\u003cstrong\u003eThe targets on this engagement are for a sports betting and gambling company.\u003c/strong\u003e\u003cbr\u003e\n\u003cstrong\u003eBugcrowd cannot be held liable if a Security Researcher breaches their country’s anti-gambling laws.\u003c/strong\u003e\u003cbr\u003e\n\u003cstrong\u003eBugcrowd cannot give legal advice to any Security Researcher about their country’s laws or whether they should proceed with testing on the listed targets.\u003c/strong\u003e\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the following table as reference:\u003c/em\u003e\u003c/p\u003e\n\n\u003ch4\u003eExample vulnerabilities by priority level:\u003c/h4\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003ePriority\u003c/th\u003e\n\u003cth\u003eExample Vulnerability\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eP1\u003c/td\u003e\n\u003ctd\u003ePredict, influence the outcome of a game or perform a successful action against the rules of a game leading to a financial impact.\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eP2\u003c/td\u003e\n\u003ctd\u003eAbility to perform a free-spin on out of bounds bases, Modification of permitted amount of a free-spin.\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eP3\u003c/td\u003e\n\u003ctd\u003ePerform a successful action against the rules of a game not leading to a financial impact.\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003cp\u003e\u003cem\u003eHowever, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"ef2b9ee7-7f73-4978-9530-ad18bbf3f902","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as In-Scope. Any domain/property of Entain not listed in the targets section is out of scope. This includes any/all subdomains not listed above.  If you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Entain, it may be reported to this program, and is appreciated - but will ultimately be marked as ‘not applicable’ and will not be eligible for monetary compensation.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eAll of our games are publicly accessible across all our assets below.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eTo create an account on these websites, you'll need to use a VPN from the UK or USA and provide an address from the corresponding country.\u003c/strong\u003e\u003c/li\u003e\n\u003cli\u003eTo find those games, you will need to connect to the casino part of the asset in scope, search for the game, login to play.\u003c/li\u003e\n\u003cli\u003eAn account will be necessary for the researchers to be able to test the game.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eCredentials:\u003c/h3\u003e\n\n\u003cp\u003eAccounts on all publicly facing targets can be self-provisioned. Please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eFocus Areas:\u003c/h2\u003e\n\n\u003ch4\u003eGame Logic Flaws\u003c/h4\u003e\n\n\u003cp\u003eThis program focuses on Game and Business Logic Flaws. Meaning that we want so see if you are somehow able to use the in game logic to gain an unfair advantage over the game or other players.\u003cbr\u003e\nFor example:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eCan you place a bet with a negative stake ?\u003c/li\u003e\n\u003cli\u003eCan you play with insufficient funds in the account ?\u003c/li\u003e\n\u003cli\u003eCan you circumvent a game to run against the defined game rules ?\u003c/li\u003e\n\u003cli\u003eCan you predict outcomes of a game ?\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eKnowledge Base:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eA \u003ccode\u003eGame Engine Map\u003c/code\u003e is available in the \u003ccode\u003eResources\u003c/code\u003e tab on the program brief, and \u003cspan class=\"rp-resources__download-link bc-m-0 bc-icon bc-icon--after cc-icon--download\" data-tooltip-id=\"e9366dff-e91e-4716-958a-35d248179c19\"\u003e\u003ca href=\"https://bugcrowd.com/engagements/entain-glf-mbb-og/attachments/e9366dff-e91e-4716-958a-35d248179c19\" download\u003ehere\u003c/a\u003e\u003c/span\u003e. This map will allow you to see what games across all platforms are utilizing the same engine.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eCurrent employees, former employees, and any members of their immediate families are not eligible to participate in this Bug Bounty Program.\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eThe following submission types are excluded from our program:\n\n\u003cul\u003e\n\u003cli\u003eAnything that is not related to Game/Business Logic Flaws\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e Any form of social engineering that is needed to achieve a flaw.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eThird party services\u003c/h2\u003e\n\n\u003cp\u003eEntain uses third-party providers and services – including a number hosted on subdomains across our brands that will be considered Out of Scope for this program.\u003cbr\u003e\nWe cannot authorise security testing against systems that do not belong to us, however we would encourage you to report any issues identified within these services to the third-party directly. However, if you believe an issue with one of our third-party service providers is the result of Entain's misconfiguration or insecure usage of that service, we would appreciate it greatly if you could share your finding.\u003c/p\u003e\n\n\u003cp\u003eIf you are unsure if a particular asset is in scope or sits with a third party within this program, please reach out to \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/home\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support Portal\u003c/a\u003e and we will help you out.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support\u003c/a\u003e and create a support ticket.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"1718dfb6-6d35-4cbc-a0ff-69248030adde","name":"In Scope","targets":[{"id":"24cf612e-4939-45ba-9a2e-6b46500167ab","uri":"https://casino.partycasino.com","name":"https://casino.partycasino.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"22c77d94-de69-4daf-a178-fd4390ec3e0d","sortOrder":0},"sortOrder":0,"tags":[{"id":"c2f2c6ac-2793-4871-a93d-2cf8c9ae10cc","name":"Games","targetId":"24cf612e-4939-45ba-9a2e-6b46500167ab"}],"recentChangeFlags":null},{"id":"4049c46b-57a3-4b47-a7e8-78c40e4d8c44","uri":"https://casino.bwin.com","name":"https://casino.bwin.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4c972a4c-a6dd-43e9-9cb9-d85ce8b84211","sortOrder":0},"sortOrder":0,"tags":[{"id":"c2f2c6ac-2793-4871-a93d-2cf8c9ae10cc","name":"Games","targetId":"4049c46b-57a3-4b47-a7e8-78c40e4d8c44"}],"recentChangeFlags":null},{"id":"2511c0cf-fd04-4e89-bb09-ae9994de13bb","uri":"https://casino.sportingbet.com","name":"https://casino.sportingbet.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"2ee04ce2-780e-49a5-98d2-1c584ad3acb8","sortOrder":0},"sortOrder":0,"tags":[{"id":"c2f2c6ac-2793-4871-a93d-2cf8c9ae10cc","name":"Games","targetId":"2511c0cf-fd04-4e89-bb09-ae9994de13bb"}],"recentChangeFlags":null},{"id":"13579f7b-978a-4524-a5ff-63170c1f46cc","uri":"https://www.ladbrokes.com/en/games","name":"https://www.ladbrokes.com/en/games","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"640c483e-a045-4833-9dba-4a4a593b9b49","sortOrder":0},"sortOrder":0,"tags":[{"id":"c2f2c6ac-2793-4871-a93d-2cf8c9ae10cc","name":"Games","targetId":"13579f7b-978a-4524-a5ff-63170c1f46cc"}],"recentChangeFlags":null},{"id":"dd1c24f5-519a-47ae-afe5-0eea1fb832e1","uri":"https://www.coral.co.uk/en/games","name":"https://www.coral.co.uk/en/games","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6b16d2cb-2417-46c4-b426-4884fc1adb90","sortOrder":0},"sortOrder":0,"tags":[{"id":"c2f2c6ac-2793-4871-a93d-2cf8c9ae10cc","name":"Games","targetId":"dd1c24f5-519a-47ae-afe5-0eea1fb832e1"}],"recentChangeFlags":null},{"id":"5b3e8a87-0f73-4b1a-8208-caea72d0368b","uri":"","name":"https://casino.*.betmgm.com/en/games (read \"Find a Game to test on our targets\")","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0ed70602-d174-4418-ab70-29d72f2d8a78","sortOrder":0},"sortOrder":0,"tags":[{"id":"c2f2c6ac-2793-4871-a93d-2cf8c9ae10cc","name":"Games","targetId":"5b3e8a87-0f73-4b1a-8208-caea72d0368b"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"e9471d38-3647-4cf0-9084-17028fdf0d2d","p1MaxCents":650000,"p1MinCents":610000,"p2MaxCents":250000,"p2MinCents":210000,"p3MaxCents":80000,"p3MinCents":30000,"p4MaxCents":null,"p4MinCents":null,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":1000000},"descriptionHtml":"\u003ch2\u003eFind a Game to test on our targets:\u003c/h2\u003e\n\n\u003cp\u003eThe process for finding and accessing a game is the same: connect to the casino section of the website, search for the game, and login to play.\u003cbr\u003e\nOnly the games listed here: \u003ca href=\"https://bugcrowd.com/engagements/entain-glf-mbb-og/attachments/e9366dff-e91e-4716-958a-35d248179c19\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eEntain-Casino-Games-Engine-List.pdf\u003c/a\u003e are in scope. The websites that host the games  are \u003cstrong\u003eNOT\u003c/strong\u003e in scope for this bug bounty program. \u003c/p\u003e\n\n\u003cp\u003eYou will need to create an account in order to test the game. \u003c/p\u003e\n\n\u003ch3\u003eBetMGM USA sites\u003c/h3\u003e\n\n\u003cp\u003eTo ensure a seamless user experience and comply with GeoIP restrictions, we kindly request that you visit our website at www.betmgm.com. \u003cbr\u003e\nUpon accessing the site, you will be directed to the appropriate state location or provided with a default option for your convenience. \u003cbr\u003e\nPlease note that the URL may differ based on your specific location. For instance, if you are in New Jersey it will resolve to:  \u003ccode\u003ehttps://casino.nj.betmgm.com/en/games\u003c/code\u003e\u003c/p\u003e","rewardRangeData":{"1":{"min":6100,"max":6500},"2":{"min":2100,"max":2500},"3":{"min":300,"max":800},"4":{"min":null,"max":null},"5":{"min":null,"max":null},"programMax":10000},"recentChangeFlags":null}],"resources":[{"id":"e9366dff-e91e-4716-958a-35d248179c19","attachmentPath":"https://bugcrowd.com/engagements/entain-glf-mbb-og/attachments/e9366dff-e91e-4716-958a-35d248179c19","name":"Entain-Casino-Games-Engine-List.pdf","filename":"Entain-Casino-Games-Engine-List.pdf","description":null,"icon":"fileOther","size":62794,"sizeLabel":"61.3 KB","uploadedAt":"30 Jul 2024","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/entain-glf-mbb-og/attachments/e9366dff-e91e-4716-958a-35d248179c19"}],"engagement":{"id":"728e7246-caa8-45bc-b514-e969e7e53e93","code":"entain-glf-mbb-og","state":"in_progress","endsAt":null,"bountyId":"91fdf193-4ecb-4d43-97eb-43dcc9c73294","startsAt":"2024-01-16T07:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Entertainment","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/1181/bd25/698b292e/e7fad5f9d17062a848f04ae577d712f0_e7867d9bc708190c2d7ce2baba6e4262_1607589296370.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2024-01-16T07:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/entain-glf-mbb-og","changelogs":"/engagements/entain-glf-mbb-og/changelog","submissions":null,"announcements":"/engagements/entain-glf-mbb-og/announcements","hallOfFame":"/engagements/entain-glf-mbb-og/hall_of_fames","crowdstream":"/engagements/entain-glf-mbb-og/crowdstream"},"announcementsCount":0,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/entain-glf-mbb-og/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=entain-glf-mbb-og\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/entain-glf-mbb-og/engagement_subscribers","engagementChangelogsUrl":"/engagements/entain-glf-mbb-og/changelog","publishedAt":"2026-08-20T22:49:55.583Z","engagementChangelogUrl":"/engagements/entain-glf-mbb-og/changelog/3405453a-4ce4-4e30-ba62-ffa3af17807c","createUserFeedbacksUrl":"/engagements/entain-glf-mbb-og/feedbacks","engagementCrowdstreamUrl":"/engagements/entain-glf-mbb-og/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}