H1 HackerOne LIVE
NBA Public Bug Bounty
pays bountiesTABLE ↗
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- https://www.nba.com
- managed triage
- yes
- response efficiency
- 89%
- first response
- 2h avg
- time to bounty
- 165h avg
428 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
playerhealthvideo.nba.com | domain | yes | critical | 2026-09-20 |
portland-dev.wnba.com | domain | yes | critical | 2026-09-20 |
portland-qa.wnba.com | domain | yes | critical | 2026-09-20 |
portland.wnba.com | domain | yes | critical | 2026-09-20 |
pr-dev.nba.com | domain | yes | critical | 2026-09-20 |
pr-qa.nba.com | domain | yes | critical | 2026-09-20 |
pr.nba.com | domain | yes | critical | 2026-09-20 |
ptiw.nba.com | domain | yes | critical | 2026-09-20 |
qa.stats.nba.com | domain | yes | critical | 2026-09-20 |
raptors905-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
raptors905-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
raptors905.gleague.nba.com | domain | yes | critical | 2026-09-20 |
reno-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
reno.gleague.nba.com | domain | yes | critical | 2026-09-20 |
riograndevalley-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
riograndevalley-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
riograndevalley.gleague.nba.com | domain | yes | critical | 2026-09-20 |
ripcity-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
ripcity-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
ripcity.gleague.nba.com | domain | yes | critical | 2026-09-20 |
saltlakecity-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
saltlakecity-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
saltlakecity.gleague.nba.com | domain | yes | critical | 2026-09-20 |
santacruz-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
santacruz-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
santacruz.gleague.nba.com | domain | yes | critical | 2026-09-20 |
sems.nba.com | domain | yes | critical | 2026-09-20 |
siouxfalls-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
siouxfalls-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
siouxfalls.gleague.nba.com | domain | yes | critical | 2026-09-20 |
sky-dev.wnba.com | domain | yes | critical | 2026-09-20 |
sky-qa.wnba.com | domain | yes | critical | 2026-09-20 |
sky-qa2.wnba.com | domain | yes | critical | 2026-09-20 |
sky.wnba.com | domain | yes | critical | 2026-09-20 |
socialimpact.nba.com | domain | yes | critical | 2026-09-20 |
southbay-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
southbay-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
southbay.gleague.nba.com | domain | yes | critical | 2026-09-20 |
sparks-dev.wnba.com | domain | yes | critical | 2026-09-20 |
sparks-qa.wnba.com | domain | yes | critical | 2026-09-20 |
sparks-qa2.wnba.com | domain | yes | critical | 2026-09-20 |
sparks.wnba.com | domain | yes | critical | 2026-09-20 |
stats-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
stats-dev.nba.com | domain | yes | critical | 2026-09-20 |
stats-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
stats-qa.nba.com | domain | yes | critical | 2026-09-20 |
stats-querytoolapi.nba.com | domain | yes | critical | 2026-09-20 |
stats-trafficcop-aws-dev.nba.com | domain | yes | critical | 2026-09-20 |
stats-trafficcop-aws-prod-east1.nba.com | domain | yes | critical | 2026-09-20 |
stats-trafficcop-aws-prod.nba.com | domain | yes | critical | 2026-09-20 |
stats-trafficcop-aws-qa.nba.com | domain | yes | critical | 2026-09-20 |
stats-trafficcop-aws-uat.nba.com | domain | yes | critical | 2026-09-20 |
stats-trafficcop-dev.nba.com | domain | yes | critical | 2026-09-20 |
stats-trafficcop-prod.nba.com | domain | yes | critical | 2026-09-20 |
stats-trafficcop-qa.nba.com | domain | yes | critical | 2026-09-20 |
stats-trafficcop-uat.nba.com | domain | yes | critical | 2026-09-20 |
stats.gleague.nba.com | domain | yes | critical | 2026-09-20 |
stats.nba.com | domain | yes | critical | 2026-09-20 |
stats.wnba.com | domain | yes | critical | 2026-09-20 |
stockton-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
stockton-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
stockton.gleague.nba.com | domain | yes | critical | 2026-09-20 |
storm-dev.wnba.com | domain | yes | critical | 2026-09-20 |
storm-qa.wnba.com | domain | yes | critical | 2026-09-20 |
storm-qa2.wnba.com | domain | yes | critical | 2026-09-20 |
storm.wnba.com | domain | yes | critical | 2026-09-20 |
sun-dev.wnba.com | domain | yes | critical | 2026-09-20 |
sun-qa.wnba.com | domain | yes | critical | 2026-09-20 |
sun-qa2.wnba.com | domain | yes | critical | 2026-09-20 |
sun.wnba.com | domain | yes | critical | 2026-09-20 |
syndication-dev.nba.com | domain | yes | critical | 2026-09-20 |
syndication-qa.nba.com | domain | yes | critical | 2026-09-20 |
syndication.nba.com | domain | yes | critical | 2026-09-20 |
taiwan.nba.com | domain | yes | critical | 2026-09-20 |
teamapps.nba.com | domain | yes | critical | 2026-09-20 |
teamdirectory.nba.com | domain | yes | critical | 2026-09-20 |
teaminquiry.nba.com | domain | yes | critical | 2026-09-20 |
teamofficelist.nba.com | domain | yes | critical | 2026-09-20 |
teamportal.nba.com | domain | yes | critical | 2026-09-20 |
teamvideo.nba.com | domain | yes | critical | 2026-09-20 |
tempo-dev.wnba.com | domain | yes | critical | 2026-09-20 |
tempo-qa.wnba.com | domain | yes | critical | 2026-09-20 |
tempo.wnba.com | domain | yes | critical | 2026-09-20 |
texas-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
texas-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
texas.gleague.nba.com | domain | yes | critical | 2026-09-20 |
thisiswhyweplay.nba.com | domain | yes | critical | 2026-09-20 |
townhall.nba.com | domain | yes | critical | 2026-09-20 |
tpp.nba.com | domain | yes | critical | 2026-09-20 |
trs.nba.com | domain | yes | critical | 2026-09-20 |
valkyries-dev.wnba.com | domain | yes | critical | 2026-09-20 |
valkyries-qa.wnba.com | domain | yes | critical | 2026-09-20 |
valkyries.wnba.com | domain | yes | critical | 2026-09-20 |
videorulebook-dev.nba.com | domain | yes | critical | 2026-09-20 |
videorulebook-qa.nba.com | domain | yes | critical | 2026-09-20 |
videorulebook.nba.com | domain | yes | critical | 2026-09-20 |
voices.nba.com | domain | yes | critical | 2026-09-20 |
vote.nba.com | domain | yes | critical | 2026-09-20 |
vth.nba.com | domain | yes | critical | 2026-09-20 |
vttp.nba.com | domain | yes | critical | 2026-09-20 |
29 out of scope — black ICE, don't touch
2kleague-dev.nba.comdomain2kleague-qa.nba.comdomain2kleague.nba.comdomainak-static.cms-dev.nba.comdomainak-static.cms-qa.nba.comdomainak-static.cms.nba.comdomainarcade.nba.comdomainbrand.nba.comdomaincms-dev.nba.comdomaincms-int.nba.comdomaincms-qa.nba.comdomaincms.nba.comdomaincoalition.nba.comdomaindev.stats.2kleague.nba.comdomainevents.bal.nba.comdomainevergent.comdomaingames.nbaacademy.nba.comdomainjr.nba.comdomainleaguepass.wnba.comdomainlogin-sandbox.nba.comdomainmediacentral.nba.comdomainmindhealth.nba.comdomainnbafoundation-dev.nba.comdomainnbafoundation-qa.nba.comdomainnbafoundation.nba.comdomainpayment.nba.comdomainsmm.events.nba.comdomainstats.2kleague.nba.comdomaintotalhealth.nba.comdomain
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.