Bug Bounty and Security Reporting

The Short Version

• We pay DP for cheats and economy exploits and for security holes, at the rates in the table below.
• We do not pay a bounty for ordinary bugs, typos, or things that look odd. Those go to Report a Gremlin, which earns badges. (If you petition about a real bug or exploit, staff may also thank you with a small amount of DP right away. See The Quick Thank-You.)
• If you used the problem to gain gold, gems, items, DP, rank or anything else before you reported it, you get no reward, and your account may be disciplined.
• Test only on your own account. Never touch another student's account or data.
• Do not tell anyone else about the problem until staff say it is fixed.
• Staff decide every case, and their decision is final.

What We Reward

A report is rewarded when it is the first valid report of a problem staff did not already know about, and staff fix it. The reward is set by the most serious thing the problem lets someone do.

Level	DP	Examples
Cheat	150	Skipping a cooldown or a daily limit, getting something without paying its cost, an automation trick that gives an unfair edge, with no security impact.
Low	250	A small leak of non-private information. A flaw that needs unlikely conditions and gives little.
Medium	500	Forcing another student's account to take an action it did not choose (CSRF). Reflected script injection (XSS).
High	1,000	Duplicating gold, gems or items without limit. Reading another student's private owls, email address or IP address. Stored script injection that runs for other students. Reaching staff-only pages or powers.
Critical	2,500	Taking over any account. Reading or changing the database (SQL injection). Creating, changing or stealing DP, or any flaw in how payments or the DP ledger work.

Staff choose the level. A report that does more than one thing is paid at the highest level it reaches, once. These amounts are what we pay today and we may change them for future reports. A change never reduces a reward we already confirmed.

The same rules apply to anything not listed in the examples. If the problem lets someone cheat or breaks into something they should not reach, it is in scope.

What We Do Not Reward

These are welcome as ordinary reports and earn no DP:

• Ordinary bugs, broken pages, wrong text, typos and cosmetic problems.
• Game balance opinions, suggestions, and anything working as designed.
• A missing security header, or a complaint about rate limits, with no demonstrated harm.
• Script injection that only affects your own account (self-XSS).
• Raw output from a scanner or tool, with no explanation of what it means.

These are not allowed, and never earn a reward:

• Anything that slows down or takes down the game (denial of service), and any spam or flooding.
• Tricking staff or students (social engineering, phishing), and anything physical.
• Attacking PayPal, Cloudflare, Discord or any other service we use. Report those to the company that runs them.
• Anything found by attacking real students or using their accounts.

Ordinary bugs go through Report a Gremlin. A confirmed report earns the Gremlin Hunter badges, and staff may also send a thank-you owl. That is the recognition for ordinary bugs. It is not DP, and it is not a lesser version of a bounty.

The Quick Thank-You

If you petition about a bug or an exploit and the staff member reading it can see that you are right, they may thank you with a small, fixed amount of earned DP on the spot, without waiting for a bounty review. The sizes are 25 (thanks for reporting), 50 (a confirmed bug) and 100 (a confirmed exploit). You get an owl saying why.

• It is once per petition, and the DP goes to the account that sent the petition. Staff cannot send it to themselves, to a linked account, or to another staff account.
• Each staff member can give at most 5 of these a day, up to 200 DP in total, and each student can receive at most 150 DP a month this way. The castle has a budget, and it is not large.
• A bigger find is not paid this way. Staff pass it to the bounty review above, and anything already paid as a thank-you for the same report comes off the bounty.
• Everything else on this page still applies. A thank-you does not excuse using the problem first, and nothing about it is a promise that staff will pay one.

How to Report

Use the petition form, which is the only way to reach staff. You do not need to be signed in, but then you must give an email address you can read, because that is how staff will answer. Put SECURITY REPORT on the first line, so it is read first.

The form allows two petitions an hour and five a day. One complete report is better than five partial ones. Do not paste another student's private data into the report. Describe where it is, and stop.

For a cheat that is not a security problem, a petition is also correct. We have no separate email address for reports. Do not message staff directly, and do not post about it in chat. Staff will not read a report that arrives that way as an official one.

What to Put in a Report

1. What the problem is, in one sentence.
2. The page or feature where it happens.
3. Numbered steps that let staff repeat it exactly.
4. What you expected, and what happened instead.
5. Proof that you stopped at the minimum: a screenshot, or a copy of a response. Remove anything private.
6. The name of your account, and the date and time (with your time zone) you tested.

A report staff cannot repeat cannot be rewarded. A clear report with working steps is the quickest way through.

Testing: What Is Allowed

• Use your own account only. Use one account. If a test would need a second account, describe what you would have tested in the report and do not run it.
• Test the smallest amount needed to show the problem is real. One demonstration is proof. A hundred is farming.
• Keep to a gentle pace. A few requests by hand, not a tool running all night.

Testing: What Is Forbidden

• Keeping what the problem gave you. If it gave you gold, items or DP, tell us exactly how much and leave it for staff to remove.
• Opening, reading, changing or deleting another student's account, owls, email address, IP address or data. If you see someone's private data by accident, stop, and say so in the report. Do not copy it.
• Anything that could make the game slow, unavailable or lose data.
• Automated scanning at volume, and flooding any form.
• Passing the problem to a friend, a club or a House so that they can try it too.

Exploit First, Report Later

Using a cheat or a hole for your own gain, and then reporting it, earns no reward. It may also lead to the gold, items, DP or rank being removed and to a temporary ban or a locked account, under the existing no cheating rule. The same applies if you help anyone else use it. The rule that you must report an exploit you find, and not use it, was already in the rules. This page adds the bounty.

Staff look at account history before paying. If the history shows use of the problem before the report, there is no reward, whatever the report says.

Duplicates and Timing

• Only the first valid report of a problem is rewarded. Staff decide which report was first by the date and time they received it.
• A problem staff already knew about, or that is already public, is a duplicate and earns nothing.
• Staff will acknowledge your report within 7 days and give you a decision within 30 days of acknowledging it. Both are targets, not guarantees, and the castle is staffed by volunteers. If you have heard nothing after that time, send one short follow-up as a new petition that quotes your first one.
• Staff may ask you questions. If you do not answer, the report may be closed.
• Reports of the same problem found by more than one student are decided by the first valid report only. Later ones get a thank-you and no DP.

No Public Disclosure Before the Fix

Do not describe the problem to anyone else, in chat, on Discord, on a forum, in a video or on social media, until staff tell you it is fixed. That includes describing it vaguely. Telling others before it is fixed voids the reward and counts as using the problem. After staff confirm the fix, you may talk about it. Please do not include private data from other students.

Safe Harbor for Good-Faith Testers

If you test in good faith and follow every rule on this page, staff will not ban or lock your account for the testing, and Hogwarts Live will not bring a legal complaint against you for it. Good faith means: you stay inside the rules above, you use the minimum testing needed, you do not keep or copy anyone's data, you do not harm other students or the game, and you stop and report as soon as you find something.

This promise comes from the game's owner and covers only Hogwarts Live. It does not bind PayPal, Cloudflare, Discord or anyone else, and it is not legal advice. If you step outside the rules, the promise does not apply. If you are unsure whether something is allowed, ask in a petition before you do it.

About the Points

• Rewards are earned DP. They are a game currency. They have no cash value, cannot be cashed out, and cannot be exchanged for money.
• Staff grant rewards by hand. Nothing in the game pays a bounty on its own.
• Receiving any DP can open parts of the game that are available to donors, for example the Prefect's Lounge entry check at the Lodge.
• If a reward was granted by mistake, or the report is later found to be false, staff may take it back.

Who Can Claim a Reward

• Any student with an account in good standing when the report is decided.
• Not staff, and not anyone who is paid or contracted to work on the game's code or servers. Finding problems is already part of that work.
• Not a banned or locked account, and not an account that has broken the rules in the course of the report.
• One reward per problem. It goes to the account that filed the first valid report. Rewards are not split, and cannot be passed to another account.

Staff Decide

Staff decide whether a report is in scope, whether it is a duplicate, how serious it is, whether the rules were followed, and how many DP it earns. Staff will explain the decision. The decision is final. Staff may change this policy at any time, and the date below shows the latest version. A report is judged under the version in force on the day staff received it.

Related Pages

• Report a Gremlin, for ordinary bugs
• Petition System, how petitions work
• The House Rules

Last updated: October 21, 2026.