Xbox vs PlayStation vs Steam vs Riot: $100K Bounty Gap [2026]

Five of the biggest names in gaming pay cash for bugs, and the gap between the smallest and largest checks is enormous. Valve tops out at $7,500 for a critical Steam flaw. Riot Games will cut a $100,000 check for a single working exploit against its Vanguard kernel driver. Epic Games has paid out more than $9.2 million total since 2021. Microsoft and Sony run their programs on entirely different infrastructure, with different rules about what counts and what gets rejected outright.

For a security researcher deciding where to spend a weekend hunting for remote code execution bugs, or a studio security lead benchmarking their own disclosure program, these differences matter. This comparison breaks down how Xbox, PlayStation, Steam, Riot Games, and Epic Games structure their bug bounty programs as of October 2026: what they pay, what they exclude, which platform handles intake, and what years of public program data says about where the real money is.

·

Google · Preferred Sources

Don't miss new tech stories on Google

Add Tech Insider once in the Google app and our stories appear in your news suggestions.

Add Now

Why game platform bug bounties work differently than enterprise software

Most enterprise bug bounty programs care about one thing: keeping attackers out of customer data. Game platforms care about that too, but they also have to defend against their own paying customers. A Steam or Xbox Live account takeover is a financial crime. A kernel-level anti-cheat bypass is a threat to competitive integrity across an entire title. A payment bypass that lets a player buy a skin for free is a direct revenue leak. That third category barely exists in enterprise security, and it explains why Epic Games pays $15,000 for a report describing how to “bypass the payment process to complete purchases in-store or in-game without payment,” according to its published HackerOne policy.

Anti-cheat adds a second wrinkle. Riot Games runs Vanguard, a kernel-mode driver that has drawn its own share of scrutiny for loading at Windows boot in its original form. Riot’s response has been to put a price on breaking it: up to $100,000 for a no-user-interaction exploit that achieves kernel-level code execution through the Vanguard driver, per Riot’s HackerOne policy page. That is the single highest named payout of any gaming company bounty table reviewed for this article, and it reflects how much a kernel-mode security hole is worth to a company whose entire anti-cheat pitch rests on that driver staying untouchable.

A third difference: scope exclusions. Valve explicitly states that “game bugs, glitches, and gameplay exploits” are not eligible for its bounty program. That sounds obvious until you realize how much of the traffic a game studio’s security team fields is exactly that: someone found a wallhack, a duplication glitch, or a way to walk through a wall in Counter-Strike 2, and wants to get paid for it. These five companies have each drawn their own line between “security vulnerability” and “game design bug,” and the line matters for anyone submitting a report.

The five programs at a glance

Before digging into specifics, here is how the five programs stack up on the metrics that matter most to a researcher deciding where to submit a report.

Company	Program name	Intake platform	Launched	Minimum reward	Standard critical range	Published top/exceptional payout	Anti-cheat kernel bounty	Public lifetime total
Microsoft (Xbox)	Xbox Bounty Program	Self-hosted via MSRC	Not separately disclosed	$1,250	Up to $20,000	$20,000 (discretionary increases possible)	Not a listed category	Not published per-program
Sony (PlayStation)	PlayStation Bounty Program	HackerOne	June 2020	$50	$5,000–$10,000 (web/mobile)	$3,000–$70,000	Not a listed category	Not publicly broken out
Valve (Steam)	Valve Bug Bounty	HackerOne	May 2018	$100	$7,500 (Steam, CS2, Dota 2, Artifact, Half-Life: Alyx)	$7,500 standard ceiling	Not a listed category	Not publicly broken out
Riot Games	Riot Games Vulnerability Program	HackerOne	Vanguard scope added April 2020	$50	Discretionary, tiered by impact	$100,000 (Vanguard kernel RCE)	Yes, up to $100,000	Not publicly broken out
Epic Games	Epic Games Bug Bounty	HackerOne	October 2021	$200	$12,000–$25,000	$7,000–$100,000 (top bounty range)	Not a listed category	$9,200,734 (reported on current program page)

That lifetime total from Epic is worth sitting with for a second. Epic’s own HackerOne page lists $9,200,734 paid out since the program launched in October 2021, plus a trailing 90-day total of $545,550 at the time this figure was published. That is a company that has spent years treating its bounty program as a standing budget line, not a one-off PR gesture.

Microsoft Xbox: the self-hosted outlier

Xbox is the one program on this list that does not route through HackerOne or Bugcrowd. Reports go through Microsoft’s own Microsoft Security Response Center (MSRC), the same intake system that handles Windows, Azure, and every other Microsoft bounty line. That single fact changes the researcher experience in ways that matter.

Microsoft’s published Xbox Bounty Program page lists a payout range of $1,250 to $20,000 for qualifying vulnerabilities in the Xbox Live network and services, with the note that “higher awards are possible, at Microsoft’s sole discretion, based on the severity and impact of the vulnerability.” The scope explicitly extends to third-party and open-source components bundled into the Xbox service stack, which is a broader net than some competitors cast. One quirk in Microsoft’s rules: when a single report could technically qualify for multiple award categories, Microsoft pays only the single highest qualifying amount rather than stacking rewards.

Microsoft’s broader MSRC bounty guidelines publish a separate report-quality matrix that most researchers should know about even outside the Xbox-specific table: a “high-quality” critical report nets $5,000, a medium-quality critical report nets $3,000, and a low-quality critical report nets $1,500, with “important”-severity reports paying roughly half those amounts. Quality of the write-up is treated as a formal multiplier on the payout, not an informal nicety. Submissions go through the Microsoft Bounty Legal Safe Harbor, Rules of Engagement, and Bounty Program Guidelines, legal language that spells out researchers will not face legal action for good-faith testing within scope.

Sony PlayStation: the program that just got a raise

Sony’s PlayStation Bounty Program, run through HackerOne, launched in June 2020 and has gone through a significant payout restructuring. According to PlayStation’s own HackerOne updates page, Sony raised payouts “across all severity levels for both web and mobile submissions effective immediately,” while leaving console-specific payouts unchanged. The new bands: Low severity pays $250–$500, Medium pays $800–$1,600, High pays $3,000–$5,000, and Critical pays $5,000–$10,000.

Here’s the detail that catches people off guard: PlayStation’s bounty table version history shows a top bounty range of $3,000 to $70,000, a ceiling far above the $10,000 standard critical band. That $70,000 figure only applies to exceptional reports Sony evaluates outside the standard severity table, and the company states explicitly that “bounty decisions and amounts are determined at Sony’s discretion and depend on severity and report quality.” PlayStation’s minimum reward sits at just $50, among the lowest floors of any program in this comparison, which makes it approachable for researchers reporting lower-severity findings they want documented rather than ignored.

Valve Steam: the lowest ceiling, the widest game library

Valve’s bug bounty program, launched publicly in May 2018 and covered at the time by Game Developer, remains the most conservative payout structure of the five. The Steam platform itself tops out at $7,500 for critical vulnerabilities, with High severity at $2,500, Medium at $750, and Low at $200. That same $7,500 critical ceiling applies to Valve’s flagship live titles: Counter-Strike 2, Dota 2, Dota Underlords, Artifact, and Half-Life: Alyx. Older titles get a smaller ceiling still: Team Fortress 2, Left 4 Dead 2, and the original Left 4 Dead cap critical payouts at $2,500.

Valve’s scope documentation is unusually specific about what counts: the Steam Client, Steam Client Service, SteamCMD, the Steamworks SDK, Steam’s mobile applications, Steam’s servers, and a named list of websites. For eligible games, in-scope targets include “game-client and server binaries, first-party unmodified game servers, and game coordinators.” The exclusion that trips up the most submitters: Valve states flatly that “game bugs, glitches, and gameplay exploits” fall outside the bounty program entirely. If a title isn’t explicitly listed in Valve’s bounty tables, Valve says it isn’t eligible for a cash reward at all, though Valve notes it may still triage critical reports on unlisted titles even without paying for them.

Riot Games: the kernel driver bounty that dwarfs everyone else

Riot Games runs its vulnerability disclosure program through HackerOne with a minimum reward of just $50. Riot’s policy states rewards are “granted entirely at the discretion of Riot.” What makes Riot’s program the standout entry in this comparison is a special bounty table reserved for one specific target: the Vanguard kernel driver.

Riot’s published Vanguard bonus table, added to the program scope on April 17, 2020 alongside the formal introduction of VALORANT, breaks down as follows: a network attack requiring no user interaction that achieves kernel-level code execution pays $100,000, the single highest figure in this entire comparison. A no-user-interaction attack that extracts sensitive data pays $75,000. A one-click network attack reaching kernel-level code execution also pays $75,000. A one-click attack that reaches sensitive data pays $50,000. Kernel-level privilege escalation sits at $35,000. Riot’s own language frames the rationale plainly: Vanguard “leverages a kernel driver to combat cheaters more effectively,” and the elevated bounty table exists “to reinforce our commitment to our players’ security.”

That framing matters because Vanguard’s kernel-mode architecture has been one of the most publicly scrutinized anti-cheat designs in gaming, precisely because a flaw in kernel-mode code grants an attacker SYSTEM-level access to the entire machine, not just the game. Riot is effectively telling researchers: if you can break our most dangerous piece of software, it will pay more than any of its competitors pay for anything in their entire catalog.

Epic Games: the program with the biggest checkbook

Epic Games launched its bug bounty program on HackerOne in October 2021, and in the years since has built what is, by disclosed totals, the most heavily funded program of the five. Epic’s current program page states $9,200,734 paid out in total bounties, with $545,550 paid in the most recent 90-day window referenced on that page. Epic’s average bounty sits in the $667–$1,000 range, while its top bounty range stretches from $7,000 to $100,000.

Epic’s severity-based table, after an update that raised critical payouts, now reads: Low severity averages $331 within a $200–$500 band, Medium severity averages $2,110 within a $1,000–$3,000 band, High severity averages $6,476 within a $5,000–$10,000 band, and Critical severity sits at $12,000–$25,000, up from Epic’s previous critical ceiling. Specific named categories include $25,000 for remote code execution on an in-scope Epic game, store, or core infrastructure endpoint, or on another player’s computer. Authentication bypass on Epic Games Store accounts also pays $25,000, specifically excluding credential stuffing attacks. A narrower authentication bypass on other in-scope Epic assets pays $15,000, as does remote code execution outside Epic’s core infrastructure and the payment-bypass category mentioned earlier. Privilege escalation on in-scope services pays $7,500.

Epic’s minimum bounty of $200, per HackerOne’s own bounty program directory, is the highest floor of any program in this comparison. Epic does not pay out for trivial or low-severity reports the way PlayStation or Riot’s $50 minimums allow.

Pricing and payout structure compared

Here is the full payout breakdown by severity tier, pulled directly from each company’s current published HackerOne or MSRC policy page.

Severity tier	Xbox (MSRC)	PlayStation	Valve (Steam/CS2/Dota 2 tier)	Riot (standard, non-Vanguard)	Epic Games
Minimum/Low	$1,250	$250–$500	$200	$50 (discretionary floor)	$200–$500
Medium	Not separately listed	$800–$1,600	$750	Discretionary	$1,000–$3,000
High	Not separately listed	$3,000–$5,000	$2,500	Discretionary	$5,000–$10,000
Critical	Up to $20,000	$5,000–$10,000	$7,500	Discretionary (up to $100K for Vanguard)	$12,000–$25,000
Exceptional/top reported	$20,000 (discretionary increase possible)	$70,000	$7,500 (hard ceiling)	$100,000 (Vanguard kernel RCE)	$100,000

The pattern that jumps out: Valve is the only program with a hard ceiling that doesn’t move for exceptional reports. Every other company reserves room for a discretionary payout well above its stated standard range, and three of the five (PlayStation, Riot, and Epic) have a documented top-end figure north of $70,000.

Scope and exclusions: what actually gets paid

Scope is where these programs diverge the most, and where researchers lose the most time submitting reports that were never going to get paid. A few patterns stand out across the five published policies:

• Account and authentication attacks are universally in scope but universally exclude credential stuffing and brute force. Epic’s policy says this explicitly for both its $25,000 and $15,000 authentication-bypass categories.
• Payment and economy manipulation is a named, paid category at Epic ($15,000 for completing a purchase without payment) but is not listed as a standalone line item in Valve’s or Riot’s public tables.
• Gameplay exploits, glitches, and cheats are explicitly excluded by Valve. None of the five companies pay bounties for aimbot or wallhack reports through their security disclosure channel. Those get routed to in-game reporting tools instead, not HackerOne or MSRC.
• Kernel-mode anti-cheat has exactly one dedicated bounty table among the five: Riot’s Vanguard table. EasyAntiCheat (Epic-owned) and BattlEye are not covered by named kernel-exploit bounty tiers in Epic’s or any other public policy reviewed for this piece.
• Third-party and open-source components bundled into the service are explicitly in scope for Xbox, per Microsoft’s MSRC page, a broader net than Valve’s title-by-title allowlist approach.

Named bounty categories compared, line by line

Severity tables only tell part of the story, because each company also names specific vulnerability classes it will pay extra for, or explicitly exclude. Lining up every named category side by side shows where the real money concentrates.

Named category	Xbox	PlayStation	Valve	Riot	Epic Games
RCE on core/flagship infrastructure	Up to $20,000	Up to $10,000 (standard), $70,000 (exceptional)	$7,500 (Steam critical)	Discretionary	$25,000
RCE on secondary/non-core assets	Not separately listed	Not separately listed	$2,500 (older titles)	Discretionary	$15,000
Account/authentication bypass	Not a named line	Not a named line	Not a named line	Discretionary	$25,000 (Epic Games Store accounts)
Authentication bypass, other assets	Not a named line	Not a named line	Not a named line	Discretionary	$15,000
Privilege escalation	Included in standard table	Included in standard table	Included in standard table	$35,000 (Vanguard kernel-level)	$7,500
Payment/purchase bypass	Not a named line	Not a named line	Not a named line	Not a named line	$15,000
Kernel driver exploit (dedicated tier)	No	No	No	Yes, up to $100,000	No
Sensitive data exposure, no interaction	Included in standard table	Included in standard table	Included in standard table	$75,000 (Vanguard-specific)	Included in standard table
Credential stuffing / brute force	Excluded	Excluded	Excluded	Excluded	Explicitly excluded
Gameplay bugs, glitches, cheats	Out of scope	Out of scope	Explicitly excluded	Out of scope	Out of scope
Unlisted/non-flagship titles	N/A	N/A	Not eligible for payment	N/A	N/A
Minimum reward floor	$1,250	$50	$100	$50	$200

Two things stand out in this grid. First, Epic Games is the only one of the five with a named, standalone payout line for payment and purchase-bypass bugs, which makes sense given how central microtransactions are to the Epic Games Store and Fortnite’s business model. Second, Riot is the only company that breaks out a kernel-driver-specific tier at all. Every other company folds kernel-level findings into its general privilege-escalation or RCE categories rather than pricing the anti-cheat driver as its own line item.

Real-world examples: how the scope plays out

Pulling from the published policy language of each program, here are five concrete scenarios that illustrate how the scope and payout rules actually function in practice:

1. A no-click Vanguard kernel exploit. Under Riot’s table, a researcher who demonstrates a network-based attack requiring zero user interaction that achieves kernel-level code execution through Vanguard qualifies for the full $100,000, the single largest named payout among all five companies.
2. An Epic Games Store authentication bypass. A researcher who finds a way to bypass login authentication on Epic Games Store accounts (through a method other than credential stuffing) qualifies for $25,000 under Epic’s published table, the same figure Epic pays for remote code execution against its core infrastructure.
3. A Steam Client Service critical bug on a non-flagship title. Because Valve’s bounty tables only list specific eligible titles, a critical vulnerability found in a Valve game not named in that table is, by Valve’s own policy language, not eligible for a cash reward, though Valve says it may still triage the report.
4. A PlayStation web-portal critical finding submitted before Sony’s rate increase. Sony’s updates page states that “all submissions currently not paid out will follow the new payout model,” meaning researchers who submitted valid reports before the raise still benefited retroactively from the higher bands.
5. A purchase-bypass bug on the Epic Games Store. A researcher demonstrating a way to complete an in-store or in-game purchase without actually paying qualifies for $15,000 under Epic’s dedicated payment-bypass category, a scope line that doesn’t appear as a standalone item in Valve’s, Riot’s, or Sony’s public tables.

Benchmarks: how these programs compare to the wider bug bounty market

Gaming-specific payout tables only tell half the story. HackerOne’s ninth Hacker-Powered Security Report, covering roughly mid-2024 through mid-2025, found that HackerOne-hosted programs collectively paid out $81 million in bounties over that 12-month window, a 13% year-over-year increase, spread across roughly 1,950 active programs. The report also found that concentration is extreme: the top 10 programs alone accounted for $21.6 million of that total, and the top 100 programs accounted for $51 million, meaning the other roughly 1,850 programs split the remaining $30 million.

Set against that backdrop, Epic’s reported $545,550 paid in a single 90-day window works out to roughly $2.2 million annualized, which would place it comfortably inside HackerOne’s top-tier program bracket if that pace held. Riot’s $100,000 top-line Vanguard payout and Epic’s $100,000 top bounty range both sit well above the median critical payout most security researchers report seeing on general-purpose bounty platforms, where mid-five-figure critical payouts are still considered generous. That gap reflects how much gaming companies specifically value kernel-level and account-authentication findings over, say, a cross-site scripting bug on a marketing page, a distinction that shapes where experienced researchers choose to spend their time.

A separate compiled dataset of bug bounty payout statistics published in 2026 put total bounty payouts across tracked platforms at roughly $17 million to more than $20 million for the cohorts measured, with researcher counts in the 300–600 range for those specific datasets, a reminder that even within a mature program ecosystem, the number of researchers who get paid meaningful amounts stays relatively small relative to how many submit reports.

HackerOne’s own statistics dashboard documentation tracks total rewards, average reward, median reward, and median time to triage for every program on its platform, which is the mechanism that lets a studio like Epic or Riot benchmark its own responsiveness against the rest of the HackerOne ecosystem rather than guessing. None of the five companies in this comparison publish their own median time-to-triage figure on their public policy pages, which is a gap researchers consistently flag as the one piece of transparency they want most: knowing whether a submitted report will sit untouched for weeks or get a response within days shapes which program a researcher picks when a finding could plausibly apply to more than one company.

Why HackerOne dominates gaming company intake

Four of the five programs in this comparison (PlayStation, Valve, Riot, and Epic) run their disclosure intake through HackerOne’s bounty program directory, and that concentration isn’t an accident. HackerOne provides shared infrastructure that none of these companies would want to build from scratch: a researcher reputation system that follows a hacker across every program on the platform, standardized severity scoring, built-in payment rails that handle currency conversion and tax reporting, and a public disclosure workflow that lets companies choose whether a resolved report becomes publicly visible once patched.

Microsoft is the outlier precisely because it already had that infrastructure in-house before HackerOne became the default choice for the industry. MSRC predates HackerOne’s prominence in gaming by years, and Microsoft runs dozens of bounty programs across its entire product line (Windows, Azure, Microsoft 365, and Xbox among them) through the same pipeline. Building a separate HackerOne-hosted program just for Xbox would mean maintaining two parallel triage systems rather than one, so Microsoft’s choice reflects internal consistency rather than any gaming-specific strategy.

Who should target which program: five use-case recommendations

Not every researcher’s skill set lines up with every program’s scope. Based on the published payout tables and scope documents above, here is where different kinds of findings are worth the most:

• If you specialize in kernel driver and Windows internals research: Riot’s Vanguard table is the obvious target: no other program in this comparison names a kernel-mode payout tier at all, let alone one reaching six figures.
• If you specialize in account takeover and authentication logic: Epic Games pays the most for this category by a wide margin, with $25,000 for Epic Games Store authentication bypass versus lower or undisclosed figures elsewhere.
• If you’re new to bug bounty hunting and want a program with a low barrier to entry: Riot and PlayStation both have $50 minimum rewards, making it realistic to get paid, even modestly, for a solid but non-critical finding.
• If you want the broadest possible attack surface to test against: Xbox’s scope explicitly includes third-party and open-source components bundled into its service stack, a wider net than Valve’s title-by-title allowlist.
• If you work on payment and e-commerce logic flaws: Epic Games is the only program in this group with a named, separately paid bounty line for purchase-bypass bugs, at $15,000.

Migration guide: moving a studio’s disclosure process onto one of these models

Game studios evaluating whether to formalize a bug bounty program, or whether to switch platforms, can use these five programs as reference architecture. Based on the public policies reviewed, a practical migration path looks like this:

1. Audit what you’re currently paying for informally. Most studios already triage security reports through support tickets or community managers before they ever consider a formal program. Map those historical reports against a severity scale (Low/Medium/High/Critical) the way PlayStation and Epic do, before setting dollar figures.
2. Pick an intake platform. Four of the five programs in this comparison use HackerOne, and only Microsoft runs its own in-house MSRC pipeline. For most studios without a dedicated security engineering team, a managed platform like HackerOne removes the overhead of building report intake, triage workflows, and payment rails from scratch.
3. Write an explicit exclusion list before launch. Valve’s policy is the clearest model here: name exactly which titles are in scope, and state plainly that gameplay bugs, glitches, and cheat reports are out of scope for cash rewards. Without this, a studio risks being flooded with low-value gameplay bug reports mislabeled as security findings.
4. Reserve a premium tier for your highest-risk component. If your game ships a kernel-mode anti-cheat driver, a rootkit-adjacent telemetry agent, or any other ring-0 code, follow Riot’s model and price that component’s exploits well above your standard critical tier: the asymmetry in risk justifies the asymmetry in payout.
5. Publish a legal safe harbor. Microsoft’s bounty terms explicitly reference a “Bounty Legal Safe Harbor,” and HackerOne’s standard program templates include similar language. Researchers are far more likely to report in good faith, rather than sell a finding elsewhere, when they have written assurance they won’t face legal consequences for good-faith testing.
6. Revisit payout bands periodically. PlayStation’s across-the-board payout increase and Epic’s critical-tier increase to $12,000–$25,000 both show that mature programs periodically raise rates to stay competitive as researcher expectations shift. A program that never updates its table risks losing top researchers to a competitor’s.

How to submit your first report to any of these programs

The mechanics of actually submitting a report are similar across the four HackerOne-hosted programs, with Xbox’s MSRC intake following a parallel but separate process. For a first-time submitter, the practical steps look like this:

1. Read the full scope document before testing anything. Valve’s and Epic’s policy pages both name specific in-scope assets and explicitly excluded categories. Testing outside scope wastes research time and, in some cases, can violate a company’s terms of service even under a safe-harbor policy.
2. Check whether the target title is explicitly listed. Valve’s model in particular only pays for titles named in its bounty table: testing an unlisted Valve game may still get triaged, but won’t be compensated, per Valve’s own policy language.
3. Create a HackerOne account (or, for Xbox, go through Microsoft’s MSRC submission portal) and review each program’s specific report-template requirements before writing up a finding.
4. Write a reproducible proof of concept. Microsoft’s MSRC guidelines explicitly tie payout size to report quality (a high-quality critical report pays more than double a low-quality one under Microsoft’s published matrix), and that quality premium holds informally across every program in this comparison.
5. Submit through the correct channel only. None of the five companies treat public disclosure before a fix ships as acceptable under their safe-harbor terms. Submitting through the official intake channel first protects both the researcher’s eligibility for a reward and their legal safe harbor.
6. Track the report status through HackerOne’s dashboard (or Microsoft’s MSRC case tracking) rather than following up repeatedly over email, since most programs use the platform’s internal messaging for all substantive back-and-forth with the submitter.

Pros and cons of each program

Microsoft Xbox

• Pros: Broad scope including third-party and open-source components, backed by Microsoft’s mature MSRC legal and triage infrastructure.
• Cons: No gaming-specific published lifetime total, and self-hosted intake means no shared researcher reputation system like HackerOne’s.

Sony PlayStation

• Pros: Recently raised payouts across every severity tier, a low $50 minimum makes smaller findings worth submitting, and the top range reaches $70,000.
• Cons: Console-specific payouts were left unchanged in the latest raise, meaning console researchers didn’t benefit from the increase that web/mobile researchers got.

Valve Steam

• Pros: Oldest and most established program on this list (since 2018), a clear and simple severity table, and broad scope across Steam client, servers, and SDK.
• Cons: Lowest payout ceiling of the five at $7,500, older titles capped even lower at $2,500, and unlisted titles are explicitly not eligible for payment.

Riot Games

• Pros: Highest single named payout tier of any program reviewed ($100,000 for Vanguard kernel RCE), plus a low $50 entry floor.
• Cons: Standard, non-Vanguard payouts are fully discretionary with no published dollar bands, making it harder for researchers to estimate expected payout in advance.

Epic Games

• Pros: Largest disclosed lifetime total ($9.2M+), the most granular named scope categories including a dedicated payment-bypass line, and recently raised critical payouts.
• Cons: Highest minimum bounty threshold at $200, which may exclude lower-severity reports other programs would still pay for.

The verdict: who runs the strongest program, by the numbers

There isn’t a single winner here, because “strongest” depends entirely on what a researcher is good at finding. But the published data supports a few clear conclusions. For raw dollar ceiling, Riot Games and Epic Games tie at $100,000 for their top-end exceptional payouts, with Riot’s figure tied specifically to kernel-mode Vanguard exploits and Epic’s spread more broadly across its top bounty range. For transparency and predictability, PlayStation and Epic publish the most detailed severity-to-dollar tables, while Riot’s standard (non-Vanguard) payouts remain fully discretionary. For total disclosed investment, Epic Games is the clear leader among the five, with a published $9.2 million-plus lifetime total and a 90-day run rate that would put it inside HackerOne’s top-tier program bracket if sustained annually. For the lowest barrier to entry, PlayStation and Riot’s shared $50 minimum reward beats Epic’s $200 floor and Valve’s $100 floor by a wide margin.

Valve remains the outlier in the other direction: the oldest program, the simplest rules, and by far the lowest payout ceiling of the five. That doesn’t make Valve’s program weak (a $7,500 Steam critical bounty has been enough to sustain the program since 2018), but it does mean Valve is not where a researcher chasing a single large payout should start first.

Frequently asked questions

Which gaming company pays the most for a single bug bounty report?
Riot Games publishes the highest named figure: up to $100,000 for a no-user-interaction network exploit achieving kernel-level code execution against its Vanguard anti-cheat driver. Epic Games lists an equally high $100,000 figure within its broader top bounty range, though Epic does not tie that ceiling to one specific vulnerability class the way Riot does.

Does Valve pay for Counter-Strike 2 cheat reports?
No. Valve’s published policy explicitly excludes “game bugs, glitches, and gameplay exploits” from its bounty program. Cheat and exploit reports for gameplay issues are handled through Valve’s separate in-game reporting and VAC systems, not the HackerOne bounty program.

Why doesn’t Xbox use HackerOne like the other four companies?
Microsoft runs all of its bounty programs, including Xbox’s, through its own Microsoft Security Response Center (MSRC) infrastructure, which it also uses for Windows, Azure, and other Microsoft products. This predates HackerOne’s prominence in gaming and reflects Microsoft’s existing enterprise-wide security operations rather than a gaming-specific choice.

What’s the minimum payout across these five programs?
PlayStation and Riot Games both publish a $50 minimum reward, the lowest of the group. Valve’s minimum is $100, and Epic Games has the highest floor at $200, according to HackerOne’s public bounty program directory.

Has any of these companies increased its payouts recently?
Yes. Sony raised PlayStation’s web and mobile payout bands across every severity tier, explicitly stating console-specific payouts were left unchanged. Epic Games separately raised its critical-severity payout band to $12,000–$25,000, up from its previous table, according to Epic’s own HackerOne updates page.

Do these programs cover cloud and backend infrastructure, or just the game client?
It varies. Microsoft’s Xbox program explicitly includes the Xbox Live network and services plus bundled third-party and open-source components. Valve’s scope names the Steam Client, Steam Client Service, Steamworks SDK, and Steam’s servers specifically. Epic’s categories reference “core infrastructure endpoints” directly in its highest-value payout tiers. None of the five publish a fully generic “anything we own” scope: each maintains a named list of in-scope assets.

Is credential stuffing eligible for a bounty on any of these programs?
No. Epic Games’ policy explicitly excludes credential stuffing from both its $25,000 Epic Games Store authentication-bypass category and its $15,000 general authentication-bypass category. None of the five programs reviewed treat credential stuffing attacks as a bounty-eligible finding, since it relies on reused passwords rather than a vulnerability in the platform itself.

How does gaming bug bounty spending compare to the industry overall?
HackerOne’s ninth Hacker-Powered Security Report found that HackerOne-hosted programs collectively paid $81 million across roughly 1,950 programs over a 12-month period, a 13% year-over-year increase. Epic Games’ disclosed $545,550 paid in a single 90-day window would annualize to roughly $2.2 million, a pace that would place it among HackerOne’s more heavily funded programs if sustained.

Related Coverage

• Poker Spyware Hits 2 Vendors, Exposes Audit Gap [2026]
• Beyond Identity vs HYPR vs Transmit: $200K Price Gap [2026]
• Zenity vs HiddenLayer vs Straiker: $61M AI Agent Security Funding Gap [2026]
• Intel TDX vs AMD SEV-SNP vs AWS Nitro: 10% Cost Gap [2026]
• UK Police Arrest 6th Suspect in RAF Fairford Plot [2026]