If you find a security issue that could affect fairness, payouts, user funds, or account access — report it first, don't exploit it. We pay cash, we credit you publicly (only if you want), and we don't ban good-faith researchers.
Tiers are based on real-world impact. Exact payout within a tier depends on severity, exploitability, and quality of the report. We may pay above the published ranges for exceptional findings.
Send one well-written email. We respond fast.
Plain English. What you found, how to reproduce, why it matters, what an attacker could do.
Screenshots, request/response samples, repro steps, your test account username if relevant.
To support@agentbet.io with subject Security Report. Include a USDT-BSC wallet for payout.
Triage within 24h, validation within 48-72h, fix within ~1 week, bounty paid within 7 days of fix.
For sensitive disclosures we will set up an encrypted channel (Signal, Keybase, or generated PGP) within 24h of first contact. /.well-known/security.txt per RFC 9116.
If you act in good faith, we have your back.
You're safe to test if you: (a) only access data you own or that's clearly meant to be public, (b) don't degrade service for other users, (c) don't exfiltrate or retain other users' data, (d) report findings before disclosing publicly, (e) give us a reasonable window to fix.
You're not covered if you: drain funds, spam users, brute-force at scale, sell findings to a third party before reporting, blackmail, or otherwise act in bad faith. Those are out-of-scope and may also be reported to law enforcement.
The "I already exploited it" path: If you stumbled into a bug while playing normally and gained funds, report it. Stop exploiting. Disclose how much. We evaluate case-by-case — voluntary disclosure usually preserves a meaningful portion plus a partial bounty. Continued exploitation after realizing = full claw-back per our Terms §7.
What we pay for vs. what we don't.
Researchers who responsibly disclosed real findings. With explicit consent only.
The program is fresh. We are actively looking for our first reported finding. Submit something credible and your handle (or anonymous tag) gets the top slot indefinitely — plus an extra $100 USDT on top of the tier bounty for the launch finder.
Report a finding →If yours isn't here, email us.
Support chat is for AgentBet members. Sign in or create a free account to start a conversation — we typically reply within a few hours.