Bug bounties and pen tests
Strangers who find our bugs
A vulnerability disclosure policy tells security researchers how to report a flaw they find. A bug bounty also pays them for it. A penetration test is when the studio hires testers to attack it on purpose.
What a good policy promises
The US agency CISA publishes a template. If a researcher makes "a good faith effort to comply with this policy", the organisation "will consider your research to be authorized" and "will not recommend or pursue legal action related to your research."
It also promises: "Within 3 business days, we will acknowledge that your report has been received."
Quick check
Why promise not to take legal action against researchers who follow the rules?
- So people who find flaws report them, instead of staying quiet
- Because every country requires it
- So researchers can test anything they like
Show the answer
So people who find flaws report them, instead of staying quiet
A researcher afraid of being sued may never report. The promise covers only good-faith work within the rules.
Rules for researchers
The template asks researchers to:
- Report fast"Notify us as soon as possible after you discover a real or potential security issue."
- Go no further"Only use exploits to the extent necessary to confirm a vulnerability's presence."
- Give timeAllow "a reasonable amount of time to resolve the issue" before telling the public.
- Not allowedDenial-of-service tests, and tricking staff, such as phishing.
In or out?
A researcher asks Kai whether they may test if a flood of requests can knock weed races offline. Is that allowed?
- No: denial-of-service tests are not authorised
- Yes: any test is fine
- Yes, if it is done at night
Show the answer
No: denial-of-service tests are not authorised
A flood harms real players, whatever the reason. The template lists DoS tests as not authorised.
Penetration tests
The UK's National Cyber Security Centre (NCSC) defines a pen test as gaining assurance "by attempting to breach some or all of that system's security, using the same tools and techniques as an adversary might."
It "can only validate that your organisation's IT systems are not vulnerable to known issues on the day of the test."
Not instead of fixing
The NCSC says a pen test checks the studio's own process for finding and fixing flaws, "not as a primary method for identifying vulnerabilities". Remy's own reviews and scans come first.
Quick check
A clean pen test in March means Shard Garden is secure in October.
- True
- False
Show the answer
False
A pen test speaks only for the day it ran. New code and newly found flaws arrive every week after.
People, not just code
Some of the biggest risks in Shard Garden come from what players say to each other.
Bolt says: Next: moderating chat.
Fact-checked 12 October 2026
- CISA: Vulnerability Disclosure Policy Template cisa.gov
- NCSC: Penetration testing ncsc.gov.uk