Electronic Arts Vulnerability Disclosure

generated: '2026-09-06'
method: searched
probe: true
source: https://www.ea.com/security/disclosure
evidence:
- source: https://www.ea.com/security
  kind: disclosure page
  status: 200
  keywords:
  - vulnerability
  - security issue
- source: https://www.ea.com/security/disclosure
  kind: vulnerability disclosure policy
  status: 200
- source: https://www.ea.com/security/advisories
  kind: security advisories
  status: 200
- source: https://www.ea.com/security/hall-of-fame
  kind: researcher recognition
  status: 200
program:
  name: EA Vulnerability Disclosure
  policy_url: https://www.ea.com/security/disclosure
  submission_url: https://forms.ea.com/app/form?id=222
  submission_method: web form
  contact_email: null
  advisories_url: https://www.ea.com/security/advisories
  hall_of_fame_url: https://www.ea.com/security/hall-of-fame
  bug_bounty: false
  bounty_platform: null
  rewards: >-
    None. EA's submission terms state a report "grants EA all licenses needed to enable
    EA's use of the report for any purpose without notice, attribution or compensation to
    you." Recognition is via the Hall of Fame page rather than payment.
  in_scope_examples:
  - cross-site scripting
  - SQL injection
  - publicly exposed credentials
  - subdomain takeover
  - system misconfigurations with demonstrated security impact
  safe_harbor: >-
    No explicit safe-harbor clause is published. EA asks researchers to keep the issue
    confidential until it has had adequate time to investigate and address it, and cites
    CERT's Coordinated Vulnerability Disclosure guidance.
  response_commitment: >-
    None stated; EA's own disclaimer says "We may not respond to every report."
  security_txt: false
gaps:
- >-
  The programme is real and easy to find from ea.com, but it is not advertised at the
  RFC 9116 path: /.well-known/security.txt returns 404 on ea.com, www.ea.com, help.ea.com,
  accounts.ea.com, signin.ea.com and gateway.ea.com. A single security.txt naming
  https://www.ea.com/security/disclosure would make the whole programme machine-discoverable.
- >-
  No third-party bounty platform is operated: hackerone.com/ea and
  hackerone.com/electronic-arts both return 404, and bugcrowd.com/ea resolves to the generic
  Bugcrowd portal rather than an EA programme.
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com