Public bug bounty · open · no registration
Find the keys.
Get written into the game.
Three levels of Pip's PyLocket Odyssey are locked behind secret keys embedded in the shipped application. The first person to find each key is credited here and becomes a White Hat in a future version of the game. There is no cash prize, no NDA, and no application form.
Two things to know before you start. Three key submissions in total, tied to one email address, for the entire program. And the build is a 14 day trial, and the clock starts when you download it.
The three lockets
0 of 3 cracked · live
-
Level 02
The Foundry
Unclaimed
Key not yet found by anybody.
-
Level 03
Signal Garden
Unclaimed
Key not yet found by anybody.
-
Level 04
The Last Locket
Unclaimed
Key not yet found by anybody.
What this is
Pip’s PyLocket Odyssey is a small retro platformer, and it is also a live target. The game is protected with PyLocket, which encrypts the whole application on disk, decrypts individual functions in memory only while they run, and ships no source and no embedded decryption key. We think that is hard to unpick. This program is us finding out.
Inside the protected application are three secret keys, one for each locked level. Recovering a key requires getting information out of the protected artifact. That is the challenge. There is no puzzle layer, no ARG and no riddle in the artwork. It is a reverse-engineering problem and nothing else.
Submission happens inside the game client, not on this website. You type the key into the game’s key panel, the client checks it against our API, and it tells you immediately whether it was accepted and whether you were first. This site is where you read the rules and see the results.
If you find a genuine security vulnerability rather than a key, something that breaks PyLocket generally and not just this game, that matters more to us than the bounty and it does not cost you an attempt. Contact details are at the bottom of this page.
How to participate
-
Step 1. Download the build
Get the current release for Windows, macOS or Linux. Every platform ships the same three keys, so pick whichever you are happiest tearing apart. Older releases are also fair game and are kept online permanently.
The build is a 14 day trial, and the clock starts when you download it.
-
Step 2. Work on your own copy
Static or dynamic, tooling or by hand, anything you do locally is in scope. You do not need to tell us first, and you do not need to keep your method secret afterwards.
-
Step 3. Be sure before you submit
Verify locally before you spend a submission, because the count does not reset and a correct key uses one the same as a wrong one does.
Three key submissions in total, tied to one email address, for the entire program.
Keys are UUIDs, 36 characters, case insensitive on entry, so a rejected key means a wrong key and never a typo you could not see. 3f2b91c4-7e0a-4d55-9a18-6b2c0d4e8f31
-
Step 4. Submit in game
Pause the game, choose SUBMIT KEY, enter your email and the key. If it is accepted and you are first, the locket opens on this site within minutes and we contact you about your character.
Rules and scope
If something is not listed here and you are unsure, ask before you do it. We will answer within three working days and we will add the answer to this page.
In scope
- Static analysis of the shipped artifact, including bytecode, resources and manifests
- Dynamic analysis: debuggers, tracers, memory inspection, instrumentation
- Unpacking, decompiling, disassembling and patching your own local copy
- Extracting and analysing embedded strings, assets and data tables
- Emulation, virtual machines and sandboxes, including anti-VM bypass
- Automated tooling and scripts run against your own machine
- Analysing network traffic between your client and our API
- Submitting a key you found, however you found it, within your three attempts
- Publishing your findings and methodology at any time
- Collaborating with other researchers and sharing partial results
Out of scope
- Using more than one email address to extend your three attempts
- Attacking our servers, API or database: no fuzzing, no injection, no load testing
- Denial of service against any endpoint, including the leaderboard
- Social engineering of us, our contractors, or other players
- Physical access attempts to any of our property or hosting
- Accessing, altering or deleting another player's score, alias or submission
- Automated score submission or leaderboard manipulation of any kind
- Redistributing the game binary, modified or otherwise
- Selling, trading or publishing a key before its level has been awarded
- Attacking the PyLocket portal, docs site or any other PyLocket product
Safe harbour
If you stay inside the in-scope list above, we consider your research authorised. We will not pursue or support any legal action against you, we will not report you to your employer, your university, your hosting provider or law enforcement, and we will not ask a platform to remove your writeup.
You never have to tell us who you are beyond the email address a submission requires, and that address is deleted within 90 days of the level being awarded.
If you accidentally step out of scope, stop, and tell us. Coming to us first has never made anything worse for anyone and it will not start with you.
Governed by the laws of England and Wales. This statement is a commitment from the program owner, not legal advice, and it does not override the law where you live.
Questions
Three key submissions in total, tied to one email address, for the entire program.
Not three per level, and the count does not reset when a level is awarded.
Because a key is a fixed string and an unlimited budget turns a reverse-engineering problem into a guessing problem. Three submissions means the interesting work happens before you submit, which is the work this program exists to test.
It also keeps the first finder slot meaningful. Somebody who can grind is not the same as somebody who can read.
Any submission our API evaluates, whether the key was wrong or right. A correct key uses one of your three the same as a wrong one does.
A malformed key, an invalid email address, or a request that never reached us does not count. If the network drops mid submit, you do not lose one. The panel shows the remaining count before you confirm.
No. That is explicitly out of scope and it will void a win. We would rather say that plainly than catch somebody out with it later.
The build is a 14 day trial, and the clock starts when you download it.
The build stops running. Your remaining key submissions are not consumed and not forfeited, but you need a working build to enter one, so in practice the trial is the window.
Downloading again gives you a fresh build. Scores you already submitted stay on the board, and any key submissions you already spent stay spent, because the count is tied to your email address rather than to the install.
You already have it. The safe harbour statement on this page is the permission, and it covers everything on the in-scope list. There is no form to fill in and nobody to email first.
Inside the protected application, one per locked level. We will not narrow it down further, because where they are is most of the problem.
What we will say is that each key is reachable from the shipped artifact alone. You do not need anything from us, from this website, or from any other player.
The client tells you at the moment of submission. If you were first, the locket on this site opens with your alias on it within minutes, and the Hall of Fame entry follows.
A White Hat character in a future version of the game: your alias, a portrait built with you, and one line of dialogue. Credit in the Hall of Fame.
There is no cash component. We would rather say that plainly than bury it.
Yes, at any time, including before the level is awarded and including if your submission was rejected. You do not need to clear it with us and we will not ask a platform to take it down.
If you send us a link we will put it on your Hall of Fame entry.
Of course, and both submissions are accepted. Only the first valid submission of a key takes the Hall of Fame slot, and that is decided by the timestamp our API records, not by when you say you found it.
It is used to contact you if you win, and for nothing else. No marketing, no sharing with anybody, and submitting a key does not put you on a mailing list. The newsletter on this site is a separate form you have to fill in yourself.
The address is deleted within 90 days of the level being awarded. We keep a one-way fingerprint of it after that, which cannot be turned back into your address, so the three submission limit stays enforceable. Ask us to delete it sooner and we will.
Yes, and the safe harbour applies to you the same as to anybody else. We collect an email address and nothing else, and you can ask us to delete it at any time.
If you are under 13, ask a parent or guardian before you submit, because the address is a way for us to contact you.
Tell us, and it does not cost you an attempt. A flaw that breaks PyLocket generally rather than just this game matters more to us than the bounty does.
Use the contact address below. We will reply within three working days and we will credit you however you want to be credited, including not at all.
The keys are baked into shipped binaries, so a key changes only when the game does. When a level is awarded its key stays valid in the builds that carry it, and a later release may carry a new one.
Awarded or not, publishing or selling a key before its level has been awarded is out of scope.
Ask a question
Rules queries, scope clarifications, edge cases, or a genuine vulnerability report. One person reads this inbox and replies within three working days.
Delete my data
Ask us to remove an alias, a score or a submitted email address. No account needed and no verification hoops. Tell us the alias and we will confirm within seven days.