H1 HackerOne LIVE
NBA Public Bug Bounty
pays bountiesTABLE ↗
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- https://www.nba.com
- managed triage
- yes
- response efficiency
- 89%
- first response
- 2h avg
- time to bounty
- 165h avg
428 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
aces-dev.wnba.com | domain | yes | critical | 2026-09-20 |
aces-qa.wnba.com | domain | yes | critical | 2026-09-20 |
aces-qa2.wnba.com | domain | yes | critical | 2026-09-20 |
aces.wnba.com | domain | yes | critical | 2026-09-20 |
adb.nba.com | domain | yes | critical | 2026-09-20 |
aguacaliente-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
aguacaliente-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
aguacaliente.gleague.nba.com | domain | yes | critical | 2026-09-20 |
ak-static-dev.nba.com | domain | yes | critical | 2026-09-20 |
allstar-dev.nba.com | domain | yes | critical | 2026-09-20 |
amp-nba-dev.nba.com | domain | yes | critical | 2026-09-20 |
amp-nba-stage.nba.com | domain | yes | critical | 2026-09-20 |
amp-nba.nba.com | domain | yes | critical | 2026-09-20 |
api.nba.com | domain | yes | critical | 2026-09-20 |
austin-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
austin-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
austin.gleague.nba.com | domain | yes | critical | 2026-09-20 |
auth-identity-dev-ping.nba.com | domain | yes | critical | 2026-09-20 |
auth-identity-dev.nba.com | domain | yes | critical | 2026-09-20 |
auth-identity-ping.nba.com | domain | yes | critical | 2026-09-20 |
auth-identity-qa-ping.nba.com | domain | yes | critical | 2026-09-20 |
auth-identity-qa.nba.com | domain | yes | critical | 2026-09-20 |
auth-identity-uat-ping.nba.com | domain | yes | critical | 2026-09-20 |
auth-identity-uat.nba.com | domain | yes | critical | 2026-09-20 |
auth-identity.nba.com | domain | yes | critical | 2026-09-20 |
bakersfield-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
bakersfield.gleague.nba.com | domain | yes | critical | 2026-09-20 |
bal-dev.nba.com | domain | yes | critical | 2026-09-20 |
bal-qa.nba.com | domain | yes | critical | 2026-09-20 |
bal-uat.nba.com | domain | yes | critical | 2026-09-20 |
bal.nba.com | domain | yes | critical | 2026-09-20 |
bealegend.nba.com | domain | yes | critical | 2026-09-20 |
birmingham-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
birmingham-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
birmingham.gleague.nba.com | domain | yes | critical | 2026-09-20 |
bluecoats-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
bluecoats.gleague.nba.com | domain | yes | critical | 2026-09-20 |
br.nba.com | domain | yes | critical | 2026-09-20 |
canton-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
canton-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
canton.gleague.nba.com | domain | yes | critical | 2026-09-20 |
capitalcity-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
capitalcity-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
capitalcity.gleague.nba.com | domain | yes | critical | 2026-09-20 |
capitanes-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
capitanes-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
capitanes.gleague.nba.com | domain | yes | critical | 2026-09-20 |
cares-dev.nba.com | domain | yes | critical | 2026-09-20 |
cares-qa.nba.com | domain | yes | critical | 2026-09-20 |
cares.nba.com | domain | yes | critical | 2026-09-20 |
cdn-bal-dev.nba.com | domain | yes | critical | 2026-09-20 |
cdn-bal-qa.nba.com | domain | yes | critical | 2026-09-20 |
cdn-bal-uat.nba.com | domain | yes | critical | 2026-09-20 |
cdn-bal.nba.com | domain | yes | critical | 2026-09-20 |
cdn-dev.nba.com | domain | yes | critical | 2026-09-20 |
cdn-gleague-dev.nba.com | domain | yes | critical | 2026-09-20 |
cdn-gleague-qa.nba.com | domain | yes | critical | 2026-09-20 |
cdn-gleague.nba.com | domain | yes | critical | 2026-09-20 |
cdn-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
cdn-qa.nba.com | domain | yes | critical | 2026-09-20 |
cdn-uat.gleague.nba.com | domain | yes | critical | 2026-09-20 |
cdn-uat.nba.com | domain | yes | critical | 2026-09-20 |
cdn.gleague.nba.com | domain | yes | critical | 2026-09-20 |
cdn.nba.com | domain | yes | critical | 2026-09-20 |
cl-qa.nba.com | domain | yes | critical | 2026-09-20 |
cl.nba.com | domain | yes | critical | 2026-09-20 |
cleveland.gleague.nba.com | domain | yes | critical | 2026-09-20 |
coalition-dev.nba.com | domain | yes | critical | 2026-09-20 |
coalition-qa.nba.com | domain | yes | critical | 2026-09-20 |
communityassist.nba.com | domain | yes | critical | 2026-09-20 |
contact-dev.nba.com | domain | yes | critical | 2026-09-20 |
contact-qa.nba.com | domain | yes | critical | 2026-09-20 |
contact.nba.com | domain | yes | critical | 2026-09-20 |
content-api-dev.nba.com | domain | yes | critical | 2026-09-20 |
content-api-nextgen-dev.nba.com | domain | yes | critical | 2026-09-20 |
content-api-nextgen-prod.nba.com | domain | yes | critical | 2026-09-20 |
content-api-nextgen-qa.nba.com | domain | yes | critical | 2026-09-20 |
content-api-nextgen-uat.nba.com | domain | yes | critical | 2026-09-20 |
content-api-prod.nba.com | domain | yes | critical | 2026-09-20 |
content-api-qa.nba.com | domain | yes | critical | 2026-09-20 |
content-api-sandbox.nba.com | domain | yes | critical | 2026-09-20 |
content-api-uat.nba.com | domain | yes | critical | 2026-09-20 |
core-api-aws-dev.nba.com | domain | yes | critical | 2026-09-20 |
core-api-aws-prod-east1.nba.com | domain | yes | critical | 2026-09-20 |
core-api-aws-prod.nba.com | domain | yes | critical | 2026-09-20 |
core-api-aws-qa.nba.com | domain | yes | critical | 2026-09-20 |
core-api-aws-uat.nba.com | domain | yes | critical | 2026-09-20 |
core-api-dev.nba.com | domain | yes | critical | 2026-09-20 |
core-api-devint.nba.com | domain | yes | critical | 2026-09-20 |
core-api-qa.nba.com | domain | yes | critical | 2026-09-20 |
core-api-sandbox.nba.com | domain | yes | critical | 2026-09-20 |
core-api-uat-uc.nba.com | domain | yes | critical | 2026-09-20 |
core-api-uat.nba.com | domain | yes | critical | 2026-09-20 |
core-api-uc.nba.com | domain | yes | critical | 2026-09-20 |
core-api.nba.com | domain | yes | critical | 2026-09-20 |
coronavirus.nba.com | domain | yes | critical | 2026-09-20 |
corp-dev.nba.com | domain | yes | critical | 2026-09-20 |
corp.nba.com | domain | yes | critical | 2026-09-20 |
courtside.nba.com | domain | yes | critical | 2026-09-20 |
cpskyhawks-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
29 out of scope — black ICE, don't touch
2kleague-dev.nba.comdomain2kleague-qa.nba.comdomain2kleague.nba.comdomainak-static.cms-dev.nba.comdomainak-static.cms-qa.nba.comdomainak-static.cms.nba.comdomainarcade.nba.comdomainbrand.nba.comdomaincms-dev.nba.comdomaincms-int.nba.comdomaincms-qa.nba.comdomaincms.nba.comdomaincoalition.nba.comdomaindev.stats.2kleague.nba.comdomainevents.bal.nba.comdomainevergent.comdomaingames.nbaacademy.nba.comdomainjr.nba.comdomainleaguepass.wnba.comdomainlogin-sandbox.nba.comdomainmediacentral.nba.comdomainmindhealth.nba.comdomainnbafoundation-dev.nba.comdomainnbafoundation-qa.nba.comdomainnbafoundation.nba.comdomainpayment.nba.comdomainsmm.events.nba.comdomainstats.2kleague.nba.comdomaintotalhealth.nba.comdomain
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.