{"id":"959f01e3-eae4-46a9-8ef0-14bab9dd686e","engagementId":"6384acc2-9190-48dc-bce0-f16f174af26d","data":{"brief":{"id":"262c926c-6a0e-4973-bfa9-135486318609","name":"Unity Technologies","tagline":"Unity brings state-of-the-art, affordable multiplatform tools and services to developers of interactive content everywhere.","description":"\u003cp\u003eUnity Technologies is committed to helping game developers build games easily and in a secure fashion. As part of this we encourage security researchers to test our security and find the things we miss. We look forward to seeing what you find! \u003c/p\u003e\n\n\u003ch3\u003eWhat we expect from you\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eSend us a full, detailed report (discussed below) as soon as possible upon discovery of a potential security issue\u003c/li\u003e\n\u003cli\u003eRefrain from any disclosure to the public or a third-party before resolution of the issue.\u003c/li\u003e\n\u003cli\u003eMake a good faith effort to avoid privacy violations, destruction/modification of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.\u003c/li\u003e\n\u003cli\u003eIf you have compromised a Unity server you will not use it for further chained attacks. \u003c/li\u003e\n\u003cli\u003eClean up after your tests. Both automated and manual tests can leave a number of dummy and spam entries, so we ask you to do your best to remove them after you're finished.\u003c/li\u003e\n\u003cli\u003eBy sending us a report or otherwise participating in our bug bounty program, you agree that you have read and understood this policy and agree to all its terms.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eWhat you can expect from us\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eWe will respond to your bug report as quickly as we can.\u003c/li\u003e\n\u003cli\u003eWe will keep you updated on the progress of getting the issue fixed.\u003c/li\u003e\n\u003cli\u003eReward decisions are made once a week.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"46b8dcc8-bbd9-4a60-80ab-ab088c2bc3e4","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Unity not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Unity, you can report it here. However, be aware that it is ineligible for rewards or points-based compensation.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eTarget Information:\u003c/h2\u003e\n\n\u003cp\u003eUnity is a cross-platform game engine that welcomes you to test for vulnerabilities in their application.\u003c/p\u003e\n\n\u003cp\u003eFor testing you can self register for an account using your \u003ccode\u003e@bugcrowdninja.com\u003c/code\u003e email address using the following link: \u003ca href=\"https://store.unity.com/#plans-individual\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://store.unity.com/#plans-individual\u003c/a\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eExcluded submission types\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eSubdomain takeovers\u003c/li\u003e\n\u003cli\u003eDenial of service\u003c/li\u003e\n\u003cli\u003eRate limiting issues\u003c/li\u003e\n\u003cli\u003eSpamming\u003c/li\u003e\n\u003cli\u003eEmail spoofing\u003c/li\u003e\n\u003cli\u003eSelf-XSS and issues exploitable only through self-XSS\u003c/li\u003e\n\u003cli\u003e\n\u003ccode\u003ewindow.opener\u003c/code\u003e -related issues.\u003c/li\u003e\n\u003cli\u003eSSL/TLS related configuration issues (aka no SSL labs reports)\u003c/li\u003e\n\u003cli\u003eCookie security issues for non-session cookies \u003c/li\u003e\n\u003cli\u003eHTTP header security\u003c/li\u003e\n\u003cli\u003eDefense in-depth issues\u003c/li\u003e\n\u003cli\u003eLogin/Logout CSRF\u003c/li\u003e\n\u003cli\u003eAutomated tool reports\u003c/li\u003e\n\u003cli\u003ePresence of autocomplete on web forms\u003c/li\u003e\n\u003cli\u003eAttacks only exploitable on older browsers or browsers with non-default configurations\u003c/li\u003e\n\u003cli\u003eOpen redirects - unless they can be used for actively stealing tokens\u003c/li\u003e\n\u003cli\u003eReports stating software is out of date or vulnerable without a proof of concept \u003c/li\u003e\n\u003cli\u003eBest practice concerns without a demonstration of practical exploitability\u003c/li\u003e\n\u003cli\u003eContact and support forms\u003c/li\u003e\n\u003cli\u003eHTML injection that doesn't lead to XSS\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eSocial engineering (including phishing) of Unity staff or contractors\u003c/li\u003e\n\u003cli\u003eAny physical attempts against Unity property or data centers\u003c/li\u003e\n\u003cli\u003eZero days for third party services\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":"\u003cp\u003e\u0026lt;b\u0026gt;This bounty requires explicit permission to disclose the results of a submission.\u0026lt;/b\u0026gt;\u003c/p\u003e"},"scope":[{"id":"4569dd47-a14e-4679-a3c6-c5a0e9e2e2f8","name":"In Scope targets","targets":[{"id":"3e3d8a58-a0b1-4768-8f02-01e6bc1aeb1d","uri":"https://id.unity.com","name":"id.unity.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e2b833c6-56aa-4d70-9729-2883b29f600a","sortOrder":0},"sortOrder":0,"tags":[{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"3e3d8a58-a0b1-4768-8f02-01e6bc1aeb1d"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"3e3d8a58-a0b1-4768-8f02-01e6bc1aeb1d"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"3e3d8a58-a0b1-4768-8f02-01e6bc1aeb1d"},{"id":"dd477d24-b394-460d-aaf7-9bd213555968","name":"Ruby","targetId":"3e3d8a58-a0b1-4768-8f02-01e6bc1aeb1d"}],"recentChangeFlags":null},{"id":"4b6bf8f7-b203-48df-83d6-94562208d345","uri":"https://api.unity.com","name":"api.unity.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c173f15f-69ce-4476-a7ae-56ebf65fc059","sortOrder":1},"sortOrder":1,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"4b6bf8f7-b203-48df-83d6-94562208d345"}],"recentChangeFlags":null},{"id":"964f2982-421d-47cd-846b-581cc03fab1f","uri":"https://cloud.unity.com","name":"cloud.unity.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"bffdc6b3-391b-482d-8b60-3d874c515976","sortOrder":2},"sortOrder":2,"tags":[{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"964f2982-421d-47cd-846b-581cc03fab1f"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"964f2982-421d-47cd-846b-581cc03fab1f"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"964f2982-421d-47cd-846b-581cc03fab1f"}],"recentChangeFlags":null},{"id":"22e3d39c-8a33-4db6-88c8-468cbb876b71","uri":"https://store.unity.com","name":"store.unity.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b9370204-a731-4891-8c61-49b17b4cc8d2","sortOrder":3},"sortOrder":3,"tags":[{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"22e3d39c-8a33-4db6-88c8-468cbb876b71"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"22e3d39c-8a33-4db6-88c8-468cbb876b71"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"22e3d39c-8a33-4db6-88c8-468cbb876b71"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"22e3d39c-8a33-4db6-88c8-468cbb876b71"}],"recentChangeFlags":null},{"id":"be6eedbe-d20a-491e-95ad-34023a090e81","uri":"https://pay.unity.com","name":"pay.unity.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1b134d43-80ee-4d10-952b-e3036d3ff006","sortOrder":4},"sortOrder":4,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"be6eedbe-d20a-491e-95ad-34023a090e81"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"be6eedbe-d20a-491e-95ad-34023a090e81"}],"recentChangeFlags":null},{"id":"5eb9e0eb-c69a-4ea3-9402-f1db720a2467","uri":"","name":"player-login.unity.com","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"78e4e22d-f8fc-4078-a8da-cf7df33cf257","sortOrder":6},"sortOrder":6,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"5eb9e0eb-c69a-4ea3-9402-f1db720a2467"},{"id":"8442481b-5110-4077-bdd1-54fd464584f6","name":"Go","targetId":"5eb9e0eb-c69a-4ea3-9402-f1db720a2467"}],"recentChangeFlags":null},{"id":"b824c5be-b28d-49ed-a737-52438eb36f53","uri":"https://unity3d.com/get-unity/download/archive","name":"Latest Supported LTS Versions of the Unity Editor - Unity 6.x.x Standard LTS, Unity 2022.3.x / 2021.3.x xLTS (enterprise license)","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c3f3f60f-d9c4-4f4e-82ca-6b23a20dd6fd","sortOrder":7},"sortOrder":7,"tags":[{"id":"041d5363-86a6-40b1-9a02-c20f6ab39c05","name":"Linux","targetId":"b824c5be-b28d-49ed-a737-52438eb36f53"},{"id":"9c63a0f4-0db6-40da-85f0-65d0aa72bfbe","name":"Windows","targetId":"b824c5be-b28d-49ed-a737-52438eb36f53"},{"id":"c5df6ad0-33b4-40ac-b6dd-8d4038997d40","name":"macOS","targetId":"b824c5be-b28d-49ed-a737-52438eb36f53"}],"recentChangeFlags":null},{"id":"8040a4a8-c382-4c75-805c-8c54d7da2781","uri":"https://services.unity.com","name":"services.unity.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b3f7397a-7b68-417b-82f2-31e8f061ffaa","sortOrder":7},"sortOrder":7,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"8040a4a8-c382-4c75-805c-8c54d7da2781"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8040a4a8-c382-4c75-805c-8c54d7da2781"}],"recentChangeFlags":null},{"id":"cbbbbe71-813d-4bf6-a1f2-324a49cf61c6","uri":"https://unity.com/download","name":"Latest Version of the Unity Hub","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9da10a74-4531-452d-8697-916addfc9ac0","sortOrder":8},"sortOrder":8,"tags":[{"id":"041d5363-86a6-40b1-9a02-c20f6ab39c05","name":"Linux","targetId":"cbbbbe71-813d-4bf6-a1f2-324a49cf61c6"},{"id":"9c63a0f4-0db6-40da-85f0-65d0aa72bfbe","name":"Windows","targetId":"cbbbbe71-813d-4bf6-a1f2-324a49cf61c6"},{"id":"c5df6ad0-33b4-40ac-b6dd-8d4038997d40","name":"macOS","targetId":"cbbbbe71-813d-4bf6-a1f2-324a49cf61c6"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"e78e9b2b-0dad-43da-8984-34398485cb48","p1MaxCents":300000,"p1MinCents":200000,"p2MaxCents":120000,"p2MinCents":75000,"p3MaxCents":50000,"p3MinCents":25000,"p4MaxCents":20000,"p4MinCents":10000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":2000,"max":3000},"2":{"min":750,"max":1200},"3":{"min":250,"max":500},"4":{"min":100,"max":200},"5":{"min":null,"max":null}},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"6384acc2-9190-48dc-bce0-f16f174af26d","code":"unity","state":"in_progress","endsAt":null,"bountyId":"57097f9a-f93a-4d0b-85a6-7776b32dd882","startsAt":"2021-02-25T06:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Technology","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/5f85/b022/4415d2a6/7249587f1fd7362a9541a2867a8fbdea_unity_logo.png","logoBackgroundColor":"#000000","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2021-02-25T06:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/unity","changelogs":"/engagements/unity/changelog","submissions":null,"announcements":"/engagements/unity/announcements","hallOfFame":"/engagements/unity/hall_of_fames","crowdstream":"/engagements/unity/crowdstream"},"announcementsCount":5,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Priority Triage","submitReportUrl":"/engagements/unity/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=unity\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/unity/engagement_subscribers","engagementChangelogsUrl":"/engagements/unity/changelog","publishedAt":"2026-06-29T09:34:55.969Z","engagementChangelogUrl":"/engagements/unity/changelog/959f01e3-eae4-46a9-8ef0-14bab9dd686e","createUserFeedbacksUrl":"/engagements/unity/feedbacks","engagementCrowdstreamUrl":"/engagements/unity/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}