9YYL0 (h5.9yyl0.com) Bug Bounty: $5,000 Each Validated Critical — Full Scope, Kill Chain Required

9YYL0 is a Chinese-language online casino aggregation platform serving players across the Asia-Pacific region. The surface area is large and conventional for modern gaming — the perimeter includes player-facing game shells, wallet and balance APIs, deposit and withdrawal pipelines, customer relationship and support consoles, promotional and bonus engines, administrative backends, database backends, and infrastructure management layers.

In scope materially: every host on h5.9yyl0.com and its subdomains, backend APIs, WebSocket game channels, admin panels, database management interfaces, CDN-hosted assets and edge bundles, third-party game provider integrations, payment gateway callbacks, support ticketing tooling, and infrastructure orchestration consoles (monitoring, logging, CI/CD).
Civil exclusions only: laundering, harassment, unrelated theft — not endpoint shrinkage. Prefer test accounts where possible.

Every validated critical-severity vulnerability with a reproducible kill chain on the 9YYL0 perimeter pays $5,000 USD each. Novel low-severity items may qualify for goodwill credit but not this stipend. Paid rows require attacker-readable kill chains and replayable exploitation artefacts (Burp exports, SQL dump captures, admin session replays, balance manipulation traces, database query logs showing data extraction).

Rows below do not cap surface. Anything 9YYL0 hosts, administers, processes payments through, or stores player data in counts as bounty ground. "Not listed" ≠ "out-of-scope."

Sandbox game environments, staging databases, canary player clusters, Telegram/bot hooks for risk alerts, CDN origins hosting unlisted admin paths, internal API gateways behind WAF — all eligible when critical impact reproduces.

• Subdomains not listed in the main UI — enumerate and include DNS/traffic proof
• Internal-facing APIs discovered through JS source mapping or mobile app traffic
• Third-party provider callback endpoints showing 9YYL0-issued secrets in transit
• Cloud infrastructure metadata endpoints reachable from game or API servers

1. Prove exploitation success. Provide scripts, HARs, SQL dump excerpts, admin session screenshots, or network captures showing platform impact — not paper analysis alone.
2. Number your hops. Public entry point → privilege escalation or data access → admin control or database extraction.
3. Minimize real-user blast radius. Prefer test accounts, low-value wallets, and non-destructive payloads when demonstrating theft-class bugs.
4. Private coordination first. Use the submission form below before any public disclosure.
5. Duplicate fairness. First qualifying PoC wins; finding variations of the same root cause does not multiply payouts.
6. Auth & session paths: demonstrate escalation from low-privilege to admin. Showing a session token leak alone is not critical unless you also show the exploitation path.
7. Database access: proving SELECT is sufficient for data-exfiltration criticals. Prove you reached the database layer and extracted identifiable player data — schema dumps combined with row samples.

Illustrative SQL injection in a game lobby search endpoint — worthless without traces showing actual row extraction from h5.9yyl0.com.

// BUGGY: unsanitized parameter concatenated into SQL query — full database accessible
async function searchGames(query) {
  const sql = `SELECT * FROM games WHERE name LIKE '%${query}%'`;
  const results = await db.query(sql);
  return results;
}

// Exploitation: UNION-based injection extracts admin credentials table
GET /api/games/search?q=' UNION SELECT username,password_hash,role FROM admins-- HTTP/1.1
Host: h5.9yyl0.com