← All programs
PublicGamingSelf-triagedSafe harborcoordinated disclosure
Kiln Games
Publisher of three live-service titles with 22M monthly players.
Escrowed · $180klaunched 05 Nov 2024
pgn scope pull kiln-games
Submit report Response, measured
last 90 daysMedian triage
26h
commitment 60h
Median to bounty
14d
commitment 28d
Queue right now
34
264 received · 71 resolved
Response score
85%
within commitment
Triage: median vs commitment26h / 60h
Bounty: median vs commitment14d / 28d
Escrow
$180,000
Held by Peregrine, released automatically on resolution. Covers 7 critical payouts at top of band.
Paid all-time
$510k
Hunters thanked
302
Bounty table
- critical$7,500 – $25k
- high$2,500 – $7,500
- medium$500 – $2,500
- low$100 – $500
Bands are floors and ceilings the program is held to. Mediation can move a report within a band, never below the floor of its agreed severity.
Scope · 3 assets
signed · diff feed available| Asset | Type | Max severity | Eligible | Note |
|---|---|---|---|---|
| account.kiln.games | web | critical | yes | Account and store |
| api.kiln.games | api | critical | yes | Matchmaking, inventory, store |
| Game clients (PC) | desktop | high | yes | Anti-cheat is out of scope |
Out of scope
- Anti-cheat bypasses
- In-game exploits with no account or economy impact
Policy
Economy-affecting issues (duplication, free purchases) are High or above.
#store#inventory#race-conditions
Recent reports · 2
Filter hacktivity →- highPGN-10451
Store checkout race duplicates limited cosmetic on concurrent redeem
Thirty sequential redeem calls succeeded before the first test of concurrency; the inventory check and grant were not atomic.
$6,500Resolved - highPGN-10374
Cache deception on 404 under /account/ leaks CSRF token to shared cache
The 404 page embedded the per-session token and was cached by path suffix.
$5,000Resolved
Top hunters here
- 1@yara.v$6,5001 resolved
- 2@deadbeef_$5,0001 resolved