Creators of hit computer game franchises Bloons, Bloons TD and SAS: Zombie Assault for mobile and web. We have offices in Auckland, New Zealand and Dundee, Scotland. We are excited to engage with the security community to help us keep our users safe and our services secure. This is our second Bug Bounty program after a successful campaign in 2021.

Tier 1
€150 - €3,750
Tier 2
€100 - €2,500
Tier 3
€50 - €1,250
Rules of engagement
Not applicable
Not applicable
max. 10 requests/sec
Not applicable

By participating in this program, you agree to:

  • Respect the Community Code of Conduct
  • Respect the Intigriti Terms and Conditions
  • Respect the scope of the program
  • Not discuss or disclose vulnerability information without prior written consent (including PoC's on YouTube and Vimeo)

Validation times
We will validate all submissions within the below timelines, once your submission has been verified by Intigriti.
Submissions validated outside of this may be awarded a €25 bonus.

Vulnerability Severity Time to validate
Exceptional 2 Working days
Critical 2 Working days
High 5 Working days
Medium 15 Working days
Low 15 Working days

This remains at the discretion of the Ninja Kiwi Games to award.

Check our fix
We offer up to €50 bonus to verify a resolved issue for us (when requested).
This remains at the discretion of Ninja Kiwi Games to award.


Tier 1

This domain hosts the API that consumed analytics events from our game clients

Tier 1

This domain hosts the API for our mobile and PC games. Monitoring traffic through one of our game clients is the easiest method to investigate our main API. Most of our applications are available for free on Steam. Please carefully read the in-scope section regarding what sorts of exploits will be considering in-scope for this domain.

Tier 1

This domain hosts builds of Ninja Kiwi games for iOS devices.

Areas of focus:

  • The ability to download any valid build from this service will be considered a CRITICAL vulnerability.
  • We will reward any enumeration of available game builds with a Medium bounty.


Tier 2

This domain hosts static content for Ninja Kiwi games and website.

Tier 2
URL is used to share replays from our Bloons TD Battles game.

Tier 2

This domain hosts our public data API which grants open access to in-game data from our biggest games. For example player profiles, leatherboards and event information is available through this domain.

Tier 2

This domain is used by Ninja Kiwi for our URL shortener service, ie

Tier 2


Tier 3

This covers any subdomains of other than sub-domains which are managed by authorized third-party services. For example:

Tier 3

Tier 3

This is a legacy domain which powers our Flash games. Uses Flash AMF.


No Bounty

This domain will be considered out of scope unless it can be shown to allow an exploit on one of our Tier 1-3 domains.

In scope

We are happy to announce our first bug bounty program on the Intigriti platform! We've done our best to clean most of our known issues and now would like to request your help to spot the ones we missed!

Our worst-case scenarios are

  • Extracting secret keys for our cloud infrastructure access (eg AWS keys)
  • Exfiltration of player PII (email address, hashed passwords, etc)
  • Accessing internal administrator functionality for our main API (

Any useful infrastructure information:

  • Our APIs at and are key targets for this program
  • The majority of the in-scope assets are protected by Cloudflare. If you've found a vulnerability which may be exploitable if Cloudflare was bypassed please get in touch. We may accept these issues if they are exploitable after bypassing Cloudflare and are a high enough severity.

Game Data Consistency
Please be aware that we will mark exploits that manipulate a game's server-side state as "informative" or cap at Low severity if the exploits don't lead to account compromise, PII leaks, access escalation, RCE style exploit, etc.

We've included some examples to help explain the types of exploits which we won't accept or will limit to Low:

  • Injecting scores into a leaderboard
  • Changing the state of a game lobby from public to private
  • Increasing or reducing a players bank balance more than the game client would normally allow

Examples of in-scope vulnerabilities:

  • Ability to log into another users account
  • Enumerating email addresses
  • Accessing any PII for users which isn't normally accessible to the game clients
  • Accessing files or services on our servers which aren't normally accessible.

These rules are mostly applicable to, and

Would you like to help us improve our program or have some feedback to share, please send your anonymous feedback here:
Program Feedback Link
Please note this form will be checked periodically and should not be used for submission or support queries.

Out of scope

Game Applications

  • All of our game client apps are out of scope. Bugs or security issues reported for the game clients themselves will be marked as out of scope.
  • Game API's are out of scope.
  • Please do not exploit any vulnerability against accounts other than your own.


  • Any domain that is not listed in the Domains section, is out of scope for this program


  • Vulnerabilities requiring the victim to use a modified game client
  • Exploits which gives an account additional in-game currencies or items, since this does not affect other players
  • Manipulating non-authenticated server-side data (such as some leaderboard scores) unless that manipulation can lead to account compromise
  • Gaining early access to upcoming in-game content or promotional material
  • Pre-Auth Account takeover/OAuth squatting
  • Self-XSS that cannot be used to exploit other users
  • Verbose messages/files/directory listings without disclosing any sensitive information
  • CORS misconfiguration on non-sensitive endpoints
  • Missing cookie flags
  • Missing security headers
  • Cross-site Request Forgery with no or low impact
  • Presence of autocomplete attribute on web forms
  • Reverse tabnabbing
  • Bypassing rate-limits or the non-existence of rate-limits.
  • Best practices violations (password complexity, expiration, re-use, etc.)
  • Clickjacking on pages with no sensitive actions
  • CSV Injection
  • Sessions not being invalidated (logout, enabling 2FA, etc.)
  • Hyperlink injection/takeovers
  • Mixed content type issues
  • Cross-domain referrer leakage
  • Anything related to email spoofing, SPF, DMARC or DKIM
  • Content injection
  • Username/email enumeration
  • Email bombing
  • HTTP Request smuggling without any proven impact
  • Homograph attacks
  • XMLRPC enabled
  • Banner grabbing/Version disclosure
  • Open ports without an accompanying proof-of-concept demonstrating vulnerability
  • Weak SSL configurations and SSL/TLS scan reports
  • Not stripping metadata of images
  • Disclosing API keys without proven impact
  • Same-site scripting
  • Subdomain takeover without taken over the subdomain
  • Arbitrary file upload without proof of the existence of the uploaded file
  • Blind SSRF without proven business impact (DNS pingback only is not sufficient)
  • Disclosed and/or misconfigured Google API key (including maps)
  • Host header injection without proven business impact


  • In case that a reported vulnerability was already known to the company from their own tests, it will be flagged as a duplicate
  • Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited, may be excluded or be lowered in severity
  • Spam, social engineering and physical intrusion
  • DoS/DDoS attacks or brute force attacks
  • Vulnerabilities that are limited to non-current browsers (older than 3 versions) will not be accepted
  • Attacks requiring physical access to a victim’s computer/device, man in the middle or compromised user accounts
  • Recently discovered zero-day vulnerabilities found in in-scope assets within 14 days after the public release of a patch or mitigation may be reported, but are usually not eligible for a bounty
  • Reports that state that software is out of date/vulnerable without a proof-of-concept


  • Shared links leaked through the system clipboard
  • Any URIs leaked because a malicious app has permission to view URIs opened
  • The absence of certificate pinning
  • Sensitive data in URLs/request bodies when protected by TLS
  • Lack of obfuscation
  • Path disclosure in the binary
  • Lack of jailbreak & root detection
  • Crashes due to malformed URL Schemes
  • Lack of binary protection (anti-debugging) controls, mobile SSL pinning
  • Snapshot/Pasteboard leakage
  • Runtime hacking exploits (exploits only possible in a jailbroken environment)
  • API key leakage used for insensitive activities/actions
  • Attacks requiring physical access to the victim's device
Severity assessment

This program follows Intigriti's contextual CVSS standard


Where can we get credentials for the app?

For the domain, you can sign up for a free account from inside any of our recent games. Most of these games are free to play and are available on mobile stores as well as Steam.

For you can create a free account in our NK Archive application and then launch any of our legacy flash games (Bloons TD 5, etc)

All aboard!
Please log in or sign up on the platform

For obvious reasons we can only allow submissions or applications for our program with a valid Intigriti account.

It will only take 2 minutes to create a new one or even less to log in with an existing account, so don't hesitate and let's get started. We would be thrilled to have you as part of our community.

last contributors
Last 90 day response times
avg. time first response
< 2 days
avg. time to decide
< 1 week
avg. time to triage
< 2 days
Ninja Kiwi Games
closed a submission
Ninja Kiwi Games
closed a submission
Ninja Kiwi Games
closed a submission
created a submission
created a submission
Ninja Kiwi Games
closed a submission
created a submission
Ninja Kiwi Games
accepted a submission
created a submission
Ninja Kiwi Games
closed a submission