H1 HackerOne LIVE
NBA Public Bug Bounty
pays bountiesTABLE ↗
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- https://www.nba.com
- managed triage
- yes
- response efficiency
- 89%
- first response
- 2h avg
- time to bounty
- 165h avg
428 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
inclusion-qa.nba.com | domain | yes | critical | 2026-09-20 |
inclusion.nba.com | domain | yes | critical | 2026-09-20 |
indiaontrack.nba.com | domain | yes | critical | 2026-09-20 |
iowa-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
iowa-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
iowa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
jrnbaworldchampionship-QA.nba.com | domain | yes | critical | 2026-09-20 |
jrnbaworldchampionship-dev.nba.com | domain | yes | critical | 2026-09-20 |
jrnbaworldchampionship.nba.com | domain | yes | critical | 2026-09-20 |
lakeland-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
lakeland-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
lakeland.gleague.nba.com | domain | yes | critical | 2026-09-20 |
liberty-dev.wnba.com | domain | yes | critical | 2026-09-20 |
liberty-qa.wnba.com | domain | yes | critical | 2026-09-20 |
liberty-qa2.wnba.com | domain | yes | critical | 2026-09-20 |
liberty.wnba.com | domain | yes | critical | 2026-09-20 |
lockervision.nba.com | domain | yes | critical | 2026-09-20 |
lockervisionteam.nba.com | domain | yes | critical | 2026-09-20 |
login-dev.nba.com | domain | yes | critical | 2026-09-20 |
login-qa.nba.com | domain | yes | critical | 2026-09-20 |
login-uat.nba.com | domain | yes | critical | 2026-09-20 |
login.nba.com | domain | yes | critical | 2026-09-20 |
longisland-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
longisland-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
longisland.gleague.nba.com | domain | yes | critical | 2026-09-20 |
lynx-dev.wnba.com | domain | yes | critical | 2026-09-20 |
lynx-qa.wnba.com | domain | yes | critical | 2026-09-20 |
lynx-qa2.wnba.com | domain | yes | critical | 2026-09-20 |
lynx.wnba.com | domain | yes | critical | 2026-09-20 |
maine-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
maine-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
maine.gleague.nba.com | domain | yes | critical | 2026-09-20 |
manage-dev.nba.com | domain | yes | critical | 2026-09-20 |
manage-teams-dev.nba.com | domain | yes | critical | 2026-09-20 |
manage-teams-qa.nba.com | domain | yes | critical | 2026-09-20 |
manage-teams-uat.nba.com | domain | yes | critical | 2026-09-20 |
manage-teams.nba.com | domain | yes | critical | 2026-09-20 |
manage-uat.nba.com | domain | yes | critical | 2026-09-20 |
manage.nba.com | domain | yes | critical | 2026-09-20 |
mcd-dev.nba.com | domain | yes | critical | 2026-09-20 |
mcd-devint.nba.com | domain | yes | critical | 2026-09-20 |
mcd-perf.nba.com | domain | yes | critical | 2026-09-20 |
mcd-qa.nba.com | domain | yes | critical | 2026-09-20 |
mcd-uat.nba.com | domain | yes | critical | 2026-09-20 |
mcd.nba.com | domain | yes | critical | 2026-09-20 |
mcdalerts-dev.nba.com | domain | yes | critical | 2026-09-20 |
mcdalerts-devint.nba.com | domain | yes | critical | 2026-09-20 |
mcdalerts-perf.nba.com | domain | yes | critical | 2026-09-20 |
mcdalerts-qa.nba.com | domain | yes | critical | 2026-09-20 |
mcdalerts-uat.nba.com | domain | yes | critical | 2026-09-20 |
mcdalerts.nba.com | domain | yes | critical | 2026-09-20 |
mediaavail.nba.com | domain | yes | critical | 2026-09-20 |
mediaday.nba.com | domain | yes | critical | 2026-09-20 |
meetings.nba.com | domain | yes | critical | 2026-09-20 |
memphis-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
memphis-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
memphis.gleague.nba.com | domain | yes | critical | 2026-09-20 |
mercury-dev.wnba.com | domain | yes | critical | 2026-09-20 |
mercury-qa.wnba.com | domain | yes | critical | 2026-09-20 |
mercury-qa2.wnba.com | domain | yes | critical | 2026-09-20 |
mercury.wnba.com | domain | yes | critical | 2026-09-20 |
mexicogames.nba.com | domain | yes | critical | 2026-09-20 |
motorcity.gleague.nba.com | domain | yes | critical | 2026-09-20 |
mystics-dev.wnba.com | domain | yes | critical | 2026-09-20 |
mystics-qa.wnba.com | domain | yes | critical | 2026-09-20 |
mystics-qa2.wnba.com | domain | yes | critical | 2026-09-20 |
mystics.wnba.com | domain | yes | critical | 2026-09-20 |
nba-ar-app.nba.com | domain | yes | critical | 2026-09-20 |
nba.com | domain | yes | critical | 2026-09-20 |
nbaacademy-dev.nba.com | domain | yes | critical | 2026-09-20 |
nbaacademy-qa.nba.com | domain | yes | critical | 2026-09-20 |
nbaacademy.nba.com | domain | yes | critical | 2026-09-20 |
nbabroadcastmanuals.nba.com | domain | yes | critical | 2026-09-20 |
nbafedsvc-dev.nba.com | domain | yes | critical | 2026-09-20 |
nbafedsvc-qa.nba.com | domain | yes | critical | 2026-09-20 |
nbafedsvc.nba.com | domain | yes | critical | 2026-09-20 |
nbaholidaycard-dev.nba.com | domain | yes | critical | 2026-09-20 |
nbaholidaycard-qa.nba.com | domain | yes | critical | 2026-09-20 |
nbaholidaycard.nba.com | domain | yes | critical | 2026-09-20 |
nbaintl.nba.com | domain | yes | critical | 2026-09-20 |
nbameeting.nba.com | domain | yes | critical | 2026-09-20 |
nbatickets-dev.nba.com | domain | yes | critical | 2026-09-20 |
nbatickets-qa.nba.com | domain | yes | critical | 2026-09-20 |
nbatickets.nba.com | domain | yes | critical | 2026-09-20 |
nbavideo.nba.com | domain | yes | critical | 2026-09-20 |
northernarizona-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
northernarizona-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
northernarizona.gleague.nba.com | domain | yes | critical | 2026-09-20 |
nycbasketball.nba.com | domain | yes | critical | 2026-09-20 |
official-dev.nba.com | domain | yes | critical | 2026-09-20 |
official-qa.nba.com | domain | yes | critical | 2026-09-20 |
official.nba.com | domain | yes | critical | 2026-09-20 |
oklahomacity-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
oklahomacity-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
oklahomacity.gleague.nba.com | domain | yes | critical | 2026-09-20 |
ontario.gleague.nba.com | domain | yes | critical | 2026-09-20 |
pdfroster-dev.nba.com | domain | yes | critical | 2026-09-20 |
pdfroster-qa.nba.com | domain | yes | critical | 2026-09-20 |
pdfroster.nba.com | domain | yes | critical | 2026-09-20 |
peopleanalyticsportal.nba.com | domain | yes | critical | 2026-09-20 |
29 out of scope — black ICE, don't touch
2kleague-dev.nba.comdomain2kleague-qa.nba.comdomain2kleague.nba.comdomainak-static.cms-dev.nba.comdomainak-static.cms-qa.nba.comdomainak-static.cms.nba.comdomainarcade.nba.comdomainbrand.nba.comdomaincms-dev.nba.comdomaincms-int.nba.comdomaincms-qa.nba.comdomaincms.nba.comdomaincoalition.nba.comdomaindev.stats.2kleague.nba.comdomainevents.bal.nba.comdomainevergent.comdomaingames.nbaacademy.nba.comdomainjr.nba.comdomainleaguepass.wnba.comdomainlogin-sandbox.nba.comdomainmediacentral.nba.comdomainmindhealth.nba.comdomainnbafoundation-dev.nba.comdomainnbafoundation-qa.nba.comdomainnbafoundation.nba.comdomainpayment.nba.comdomainsmm.events.nba.comdomainstats.2kleague.nba.comdomaintotalhealth.nba.comdomain
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.