ShaftKings
ShaftKings.gg

Bug bounty rewards

2 min readUpdated 12 Oct 2026

We pay for security bugs that put players' accounts or money at risk. The more harm a bug could do, the more we pay, up to $50,000.

What we pay

  • Money at risk, $10,000 to $50,000: a bug that could move money that isn't yours. For example: withdrawing someone else's balance, a deposit credited without the coins arriving, seeing or setting a bet's result before you bet, or creating balance from nothing. We pay 10% of the money the bug put at risk, never less than $10,000.
  • Critical, $5,000 to $10,000: taking over any account without the owner doing anything, running code on our servers, reading our database, or getting into our admin tools.
  • High, $1,500 to $5,000: taking over an account when the owner helps, such as by clicking a link; getting around two-factor or the withdrawal checks; seeing another player's balance, bets or details; or a single request that crashes a game for everyone. Report a crash. Don't demonstrate it.
  • Medium and low: our thanks and, if you'd like, your name on our list of researchers. We may also pay for a medium bug with a clear write-up.

How we decide

  • We judge a bug by what it could do on ShaftKings today, not by a scanner's score.
  • Only the first report of a bug is paid. If two arrive for the same bug, the earlier one counts.
  • A clear report with steps that work first time can earn up to 25% more.
  • We decide the final amount and explain how we got there.

How you get paid

  1. We confirm the bug and agree the amount with you.

  2. We ask for your name and country and check them against sanctions lists, as the law requires. We may also ask for a tax form.

  3. We pay in USDC on Solana, to a wallet you give us, within 14 days of confirming the bug.

What doesn't qualify

  • Anything found by breaking our Rules for security testing.
  • A report that comes with a demand for payment, a deadline or a threat.
  • A bug you used to win, withdraw or move money.
  • A bug in another company's service, like a slot provider's game, unless it moves ShaftKings money.
  • Things that put no one at risk, such as missing security headers, email settings like SPF, DKIM or DMARC, or version numbers.

More in Security & bug bounty

Report a security issueFound a way into an account, around a check, or to money that isn't yours? Email security@shaftkings.gg. Rules for security testingWhat you can test, what's off limits, and what to do if a bug pays you. Safe harbor for security researchFollow our rules in good faith and we treat your research as authorized and won't take legal action.

Found something?

Email security@shaftkings.gg with the steps to make it happen.

security@shaftkings.gg