Driftline Games

Program overview

Read this first: the programme is paused. We are between testing windows while the Season 9 economy backend finishes rolling out. Half of what you would test this week is replaced next week, and neither of us wants to spend a weekend on that. Submissions reopen on Monday 2 November 2026.

Paused is not closed. The form stays up, and nothing sent to it gets thrown away. Anything you submit between now and 2 November is timestamped at the moment it arrives, queued, and read in order once the window opens. Your place in the duplicate queue is set by when we received the report, not by when a human got to it, and that rule was written after we got it wrong in 2025. First response runs four business days from reopening, not from your submission.

If you find something actually on fire, something that reaches into other people's accounts or mints currency out of nothing, mail the security address with PAUSE-CRITICAL in the subject line and a person looks at it the same day. That route is for emergencies, not for moving a stored scripting bug up the queue, and we notice when it is used that way.

Tidebreak is a team shooter with a player-run economy. Items are tradeable, they hold real value, and people have spent real money on them. That is why the money here bends toward the economy and matchmaking rather than the parts of our stack that look like an ordinary web app.

Testing rules and expectations

Use your own accounts. Ask and we will hand you three more with inventory and market credit; we would far rather do that than have you poking at a stranger.

Stay on the public test branch for anything that touches the economy. If it only reproduces on live, say so, get your proof, and stop. Do not complete a trade that moves value out of an account you do not control. Do not mint items and list them. Creating one item is the report. Creating four thousand and selling them is theft, and we treat it as theft whatever the write-up says afterwards.

Leave live matches alone. There are players in them and their evening matters more than your test case. No flooding, no forced disconnects, no load generation against the lobby fleet.

No social engineering of our staff, our moderators or our volunteer community managers. No phishing our players. Nothing physical, ever. If you end up holding player data, stop, tell us, and delete it once we confirm we have what we need from it.

Proving write access

If you find a way to write, do not prove it by causing damage. Prove it with the smallest change that can be attributed to you and undone in the same minute.

• One or two punctuation characters. Delete a full stop, add a comma. Nothing longer, nothing visible, no payload, no changed number or amount.
• Only on a record you created yourself. Never another user's record, never site content, never anything the public can see.
• Revert within sixty seconds, in the same run, without being asked.
• Capture four states: before, after the change, after the revert, and an independent re-read confirming the revert held.
• If it cannot be reverted, do not change it. Report the write primitive and stop. A row count and a column list already prove database access.

Every request must carry headers that let us separate your traffic from a real attack in our logs:

X-Bug-Bounty:        driftline
X-Research-Account:  <the account you submit the report under>
X-Authorisation-Ref: <engagement or report reference>
X-Request-Id:        <unique per request>
User-Agent:          sentinel-research/<handle> (+<this page>)

scripts/proof_of_write.py performs exactly this sequence, refuses any host outside the scope above, refuses a diff longer than two characters, always attempts the revert, and writes a timestamped evidence file. Run it without --execute first, then attach the evidence to your report.

Safe harbor

Test inside these rules and your work is authorised. We will not sue you, refer you for prosecution, or ban the account you tested on. If somebody else comes after you over research that stayed inside this policy, tell us and we will confirm in writing that you had our permission.

That covers security research. It does not cover playing the game dishonestly. Using a finding for an in-game advantage, to fatten an account, to sell an exploit, or to pass it to a cheat developer voids every word above, and the account goes with it. Same outcome for destroying data, disrupting live matches, or going quiet on us and publishing instead.

Reward decisions

CVSS gets us into the right neighbourhood and then we adjust for what the bug does to the game. Two things outrank their base score every time: anything that creates or duplicates value in the economy, and anything that lets you act as another player in matchmaking. Both pay Critical even where the technical severity argues for High, because both break trust in a way that shipping a patch does not repair.

Chains pay once at the severity of the outcome, plus up to 25 percent when the chain is genuinely clever. Ties break toward whoever showed impact first; an earlier hunch loses to a later working reproduction. Send a fix idea we ship and we add 10 percent.

Since June 2025 a close-as-duplicate needs a second reviewer, and the duplicate window runs from triage. That came out of a bad month: we closed a report as a duplicate when it was not, the bug shipped with Season 6, and we rolled back 41 hours of trades. The reporter was paid in full and the process changed that week.

Reports that arrive during the pause are scored as though they landed on reopening day. Nobody loses a band for submitting early.

Disclosure policy

Ninety days from triage, or the day the fix reaches live, whichever comes first. Economy bugs can take one extension of up to 45 days where the fix has to ride a season boundary, and we name the date rather than let it drift.

After that, publish what you like. Strip account identifiers, session tickets, internal hostnames and any footage showing another player's inventory. We will not ask you to soften anything. We do ask that you never publish a working exploit binary or a copy-paste payload, even after the fix lands, because old clients stay in the wild for years.

Report quality

• What breaks, in one sentence, at the top. Not in paragraph four.
• Build number and branch, live or test, with your platform and client version.
• Numbered steps from a fresh account, including the handles you used.
• For economy bugs: item identifiers, quantities before and after, and whether the change survived a shard restart.
• For network findings: the captured request or packet, and what the server sent back.
• A clip if it helps. Under two minutes, with the interesting part timestamped.
• What an attacker does with it at scale, honestly. Undersell it and we still pay it correctly.