Found something that doesn’t look right? Help us make Winna better, safer and more reliable, and you could earn a reward.
Our Bug Bounty Programme rewards eligible reports of issues affecting the Winna platform, from visual errors and broken features to payment issues and security vulnerabilities.
Reward tiers
Issue type | Examples | Reward |
Minor visual or wording issue | Typos, misaligned elements, broken images or incorrect text | Up to $1,000 |
Broken feature | A button, filter, page or process that doesn’t work as intended | Up to $2,500 |
Major gameplay or payment issue | Incorrect payouts, balance discrepancies, deposit or withdrawal failures, or errors in bet logic | Up to $10,000 |
Critical security vulnerability | Unauthorised access to funds, account takeover, privilege escalation, or wallet or smart contract vulnerabilities | Up to $50,000 |
Rewards are paid in crypto at Winna’s sole discretion. The amount depends on the severity and impact of the issue, as well as the quality of the report.
Only the first valid, reproducible report of an issue is eligible for a reward. Duplicate reports are not eligible, and the maximum amounts above are not guaranteed.
What’s in scope?
The programme covers issues affecting systems controlled by Winna, including:
The Winna website, casino functionality, and wallet and payment flows.
Winna’s APIs and backend infrastructure.
Smart contracts related to Winna deposits, withdrawals or provably fair systems, where applicable.
What’s out of scope?
The following are excluded from the programme:
Third-party services outside Winna’s control, including payment processors and game providers’ own infrastructure.
Social engineering or phishing attempts targeting Winna staff or players.
Denial-of-service attacks, including DoS and DDoS.
Attempts to gain physical access to offices or infrastructure.
Reports without sufficient evidence or reproducible steps.
How to submit a report
Email [email protected] with:
A clear description of the issue and where you found it.
Step-by-step instructions to reproduce it.
The expected behaviour and what actually happened.
Relevant screenshots, recordings or a proof of concept.
Your device, browser and the approximate date and time of the issue.
For security vulnerabilities, explain the potential impact and provide only the evidence needed to demonstrate the issue. Never include passwords, private keys, recovery phrases or two-factor authentication codes.
Report responsibly
Keep testing limited to accounts and funds you own or have explicit permission to use. Do not access other players’ accounts or data, move funds that do not belong to you, or disrupt the platform.
If you discover a vulnerability, stop once you have enough evidence to report it. Send the details privately to [email protected] and avoid sharing them publicly while the issue is being reviewed.
Thank you for helping us improve Winna.
Need help? If you require any additional assistance, feel free to contact our support team. Winna’s support team is available 24/7 via live chat or email at [email protected].