H1 HackerOne LIVE
NBA Public Bug Bounty
pays bountiesTABLE ↗
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- https://www.nba.com
- managed triage
- yes
- response efficiency
- 89%
- first response
- 2h avg
- time to bounty
- 165h avg
428 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
watch-ng.nba.com | domain | yes | critical | 2026-09-20 |
watch.global.nba.com | domain | yes | critical | 2026-09-20 |
westchester-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
westchester-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
westchester.gleague.nba.com | domain | yes | critical | 2026-09-20 |
windycity-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
windycity-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
windycity.gleague.nba.com | domain | yes | critical | 2026-09-20 |
wings-dev.wnba.com | domain | yes | critical | 2026-09-20 |
wings-qa.wnba.com | domain | yes | critical | 2026-09-20 |
wings-qa2.wnba.com | domain | yes | critical | 2026-09-20 |
wings.wnba.com | domain | yes | critical | 2026-09-20 |
wisconsin-dev.gleague.nba.com | domain | yes | critical | 2026-09-20 |
wisconsin-qa.gleague.nba.com | domain | yes | critical | 2026-09-20 |
wisconsin.gleague.nba.com | domain | yes | critical | 2026-09-20 |
wnbabroadcastmanuals.nba.com | domain | yes | critical | 2026-09-20 |
www-all.nba.com | domain | yes | critical | 2026-09-20 |
www-dev.nba.com | domain | yes | critical | 2026-09-20 |
www-dev.wnba.com | domain | yes | critical | 2026-09-20 |
www-ng.nba.com | domain | yes | critical | 2026-09-20 |
www-prod.nba.com | domain | yes | critical | 2026-09-20 |
www-qa.nba.com | domain | yes | critical | 2026-09-20 |
www-qa.wnba.com | domain | yes | critical | 2026-09-20 |
www-uat.nba.com | domain | yes | critical | 2026-09-20 |
www.nba.com | domain | yes | critical | 2026-09-20 |
www.wnba.com | domain | yes | critical | 2026-09-20 |
com.nbaimd.gametime.nba2011 | mobile | yes | critical | 2026-09-20 |
com.nbaimd.gametime.universal | mobile | yes | critical | 2026-09-20 |
29 out of scope — black ICE, don't touch
2kleague-dev.nba.comdomain2kleague-qa.nba.comdomain2kleague.nba.comdomainak-static.cms-dev.nba.comdomainak-static.cms-qa.nba.comdomainak-static.cms.nba.comdomainarcade.nba.comdomainbrand.nba.comdomaincms-dev.nba.comdomaincms-int.nba.comdomaincms-qa.nba.comdomaincms.nba.comdomaincoalition.nba.comdomaindev.stats.2kleague.nba.comdomainevents.bal.nba.comdomainevergent.comdomaingames.nbaacademy.nba.comdomainjr.nba.comdomainleaguepass.wnba.comdomainlogin-sandbox.nba.comdomainmediacentral.nba.comdomainmindhealth.nba.comdomainnbafoundation-dev.nba.comdomainnbafoundation-qa.nba.comdomainnbafoundation.nba.comdomainpayment.nba.comdomainsmm.events.nba.comdomainstats.2kleague.nba.comdomaintotalhealth.nba.comdomain
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.