Facts published by Bugcrowd on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 19 Sep 2026.

Immutable is a global leader in gaming, on a mission to bring digital ownership to every player and empower developers to build great games that scale. Immutable's full-stack product suite powers every stage of game creation and growth — from purpose-built blockchain infrastructure to player acquisition, engagement, and monetisation. Trusted by 700+ game studios and publishers, and the teams behind Gods Unchained and Guild of Guardians. Immutable provides an end-to-end platform that includes Immutable Chain (purpose-built gaming infrastructure), Passport (universal accounts and wallets for games), and an AI-powered Audience platform for player conversion, engagement, attribution, and revenue growth. No technology is perfect, and Immutable believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities across our Immutable ecosystem. Good luck, and happy hunting! Focus Area Severity is anchored to the attacker objectives below, not to CVSS base score. P1 is limited to the closed list below. Everything else is triaged at Immutable’s discretion under standard severity. Final severity is determined by Immutable. A report may qualify as P1 only if it demonstrates that an attacker can achieve one of the following outcomes: Control user funds or wallets — steal or move a user’s funds, take over a linked wallet, or compromise an account in a way that reaches funds, wallets, or transferable assets. This includes bypassing Guardian, user approval, or equivalent authorisation controls. Cause unauthorised on-chain actions — get the platform to mint an asset, or submit a transaction through the relayer, that the user did not authorise. Break tenant isolation — read or modify another organisation’s data, secrets, configuration, or OAuth clients. Severity is assessed based on impact and may result in downgrade. Compromise critical production systems — achieve remote code execution, or escalate privileges to internal/admin tooling or a privileged platform identity, on Immutable's production infrastructure.