Featured on
Featured on
— no diffs detected in snapshot history yet —
No reports yet — be the first to share your triage timing for Ninja Kiwi Games Bug Bounty program.
// peer-sourced response times. platforms won’t publish this — hunters can. anonymized in aggregate.
{
"id": "0fd1d85b-2d33-4966-b5a0-caabfda5108e",
"name": "Ninja Kiwi Games Bug Bounty program",
"company_handle": "ninjakiwigames",
"handle": "ninjakiwigames",
"url": "https://www.intigriti.com/programs/ninjakiwigames/ninjakiwigames/detail",
"status": "open",
"confidentiality_level": "public",
"tacRequired": false,
"twoFactorRequired": false,
"min_bounty": {
"value": 75,
"currency": "EUR"
},
"max_bounty": {
"value": 4125,
"currency": "EUR"
},
"targets": {
"in_scope": [
{
"type": "url",
"endpoint": "analytics.ninjakiwi.com",
"description": "This domain hosts the API that consumed analytics events from our game clients",
"impact": "Tier 1"
},
{
"type": "url",
"endpoint": "api.ninjakiwi.com",
"description": "This domain hosts the API for our mobile and PC games. Monitoring traffic through one of our game clients is the easiest method to investigate our main API. Most of our applications are available for free on [Steam](https://store.steampowered.com/developer/ninjakiwigames/#browse). Please carefully read the in-scope section regarding what sorts of exploits will be considering in-scope for this domain.",
"impact": "Tier 1"
},
{
"type": "url",
"endpoint": "guts.ninjakiwi.com",
"description": "This is the backend services for certain BTD6 in-game features such as Contested Territories and the Map Creator.",
"impact": "Tier 1"
},
{
"type": "wildcard",
"endpoint": "*.ninjakiwi.me",
"description": "ninjakiwi.me is a domain which hosts many of Ninja Kiwi's employtee only services. Any subdomain is eligible for the program.",
"impact": "Tier 2"
},
{
"type": "wildcard",
"endpoint": "*.nkstatic.com",
"description": "This domain hosts static content for Ninja Kiwi games and website.",
"impact": "Tier 2"
},
{
"type": "url",
"endpoint": "battles.tv",
"description": "Battles.tv is used to share replays from our Bloons TD Battles game.",
"impact": "Tier 2"
},
{
"type": "url",
"endpoint": "data.ninjakiwi.com",
"description": "This domain hosts our **public** data API which grants open access to in-game data from our biggest games. For example player profiles, leaderboards and event information is available through this domain.",
"impact": "Tier 2"
},
{
"type": "url",
"endpoint": "ninja.kiwi",
"description": "This domain is used by Ninja Kiwi for our URL shortener service, ie https://ninja.kiwi/intigriti.",
"impact": "Tier 2"
},
{
"type": "url",
"endpoint": "ninjakiwi.com",
"description": "Please note that the ninjakiwi.com domain has a number of subdomains which are not in-scope. These are domains which are managed by third party providers. This includes (but it not limited to):\n- support.ninjakiwi.com\n- store.ninjakiwi.com\n- btd6store.ninjakiwi.com\n- battles2store.ninjakiwi.com\n\nIf you are unsure please feel free to reach out to us at security@ninjakiwi.com.",
"impact": "Tier 2"
},
{
"type": "url",
"endpoint": "alerts.ninjakiwi.com",
"description": null,
"impact": "Tier 3"
},
{
"type": "url",
"endpoint": "boomer2.ninjakiwi.com",
"description": null,
"impact": "Tier 3"
},
{
"type": "url",
"endpoint": "ct.ninjakiwi.com",
"description": null,
"impact": "Tier 3"
},
{
"type": "url",
"endpoint": "mynk-dash.ninjakiwi.com",
"description": null,
"impact": "Tier 3"
},
{
"type": "url",
"endpoint": "mynk.ninjakiwi.com",
"description": "This is a legacy domain which powers our Flash games. Uses Flash AMF.",
"impact": "Tier 3"
},
{
"type": "wildcard",
"endpoint": "*.souparea.com",
"description": "This domain will be considered out of scope unless it can be shown to allow an exploit on one of our Tier 1-3 domains.",
"impact": "No Bounty"
}
],
"out_of_scope": [
{
"type": "url",
"endpoint": "rancher.ninjakiwi.com",
"description": null,
"impact": "Out of scope"
},
{
"type": "url",
"endpoint": "rancher.ninjakiwi.me",
"description": null,
"impact": "Out of scope"
},
{
"type": "url",
"endpoint": "store.ninjakiwi.com",
"description": "If you've found an issue with this domain you can contact Shopify here - https://www.shopify.com/bugbounty",
"impact": "Out of scope"
},
{
"type": "url",
"endpoint": "support.ninjakiwi.com",
"description": "If you've found an issue with this domain you can contact Zendesk here - https://support.zendesk.com/hc/en-us/articles/4409154830874-Zendesk-Bug-Bounty-Program",
"impact": "Out of scope"
},
{
"type": "url",
"endpoint": "icarusadmin.ninjakiwi.com",
"description": null,
"impact": "Out of scope"
}
]
}
}