H1 HackerOne LIVE
Netflix
pays bountiesTABLE ↗
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- http://netflix.com
- managed triage
- yes
- response efficiency
- 92%
- first response
- 2h avg
- time to bounty
- 88h avg
30 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
beacon.netflix.com | domain | yes | critical | 2026-09-20 |
customerevents.netflix.com | domain | yes | critical | 2026-09-20 |
help.netflix.com | domain | yes | critical | 2026-09-20 |
ichnaea.netflix.com | domain | yes | critical | 2026-09-20 |
meechum.netflix.com | domain | yes | critical | 2026-09-20 |
nmtracking.netflix.com | domain | yes | critical | 2026-09-20 |
presentationtracking.netflix.com | domain | yes | critical | 2026-09-20 |
secure.netflix.com | domain | yes | critical | 2026-09-20 |
www.netflix.com | domain | yes | critical | 2026-09-20 |
Netflix Mobile Application for Android | mobile | yes | critical | 2026-09-20 |
Netflix Mobile Application for iOS | mobile | yes | critical | 2026-09-20 |
Affiliates or entities such as recently acquired companies | other | no | critical | 2026-09-20 |
Content Authorization Targets | other | yes | critical | 2026-09-20 |
Content authorization vulnerabilities affecting only the in-browser player | other | no | critical | 2026-09-20 |
Corporate Assets | other | yes | critical | 2026-09-20 |
Low impact, individually exposed Google Docs with no common root cause (see “Publicly accessible Google Document or Drive Links” in the “Corporate Targets” section) | other | no | critical | 2026-09-20 |
Microsites | other | yes | critical | 2026-09-20 |
Netflix Gaming Target | other | no | critical | 2026-09-20 |
Open Source - Spectator | other | yes | critical | 2026-09-20 |
Open Source - Zuul | other | yes | critical | 2026-09-20 |
Secondary Assets | other | yes | critical | 2026-09-20 |
Open Source - Atlas | source code | yes | critical | 2026-09-20 |
*.nflxext.com | wildcard | yes | critical | 2026-09-20 |
*.nflximg.net | wildcard | yes | critical | 2026-09-20 |
*.nflxso.net | wildcard | yes | critical | 2026-09-20 |
*.nflxvideo.net | wildcard | yes | critical | 2026-09-20 |
*.prod.cloud.netflix.com | wildcard | yes | critical | 2026-09-20 |
*.prod.dradis.netflix.com | wildcard | yes | critical | 2026-09-20 |
*.prod.ftl.netflix.com | wildcard | yes | critical | 2026-09-20 |
api*.netflix.com | wildcard | yes | critical | 2026-09-20 |
9 out of scope — black ICE, don't touch
ir.netflix.comdomainir.netflix.netdomainnetflixinvestor.comdomainAssets associated with ReadyPlayerMeotherOpen Source - ConsolemeotherOpen Source - DispatchotherOpen Source - WeepotherSet-top-boxes, smart TVs, streaming sticks Out of ScopeotherThird party websites or systems hosted by non-Netflix entities Out of Scopeother
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.