Flutter UK & Ireland bug bounty programs
flutter.com Updated
Flutter UK & Ireland runs one public program: a HackerOne bug bounty paying up to $5,000.
- Top reward
- $5,000
- HackerOne
- Programs
- 1
- 1 pays cash
- Targets in scope
- 44
- 3 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program Flutter UK & Ireland runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Flutter UK&I
HackerOne · Bug bounty |
$5,000 | $2,500 | $600 | $250 | $5,000 | – | – | 3 hours average | Open |
-
- Critical
- $5,000
- High
- $2,500
- Medium
- $600
- Low
- $250
- First response
- 3 hours average
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
44 targets. 36 excluded.
-
*.betfair.com
Wildcards Critical
-
*.betfair.es
Wildcards Critical
-
*.betfair.it
Wildcards Critical
-
*.betfair.ro
Wildcards Critical
-
*.betfair.se
Wildcards Critical
-
*.betsharedservices.io
Wildcards Critical
-
*.betviewapi.com
Wildcards Critical
-
*.dibz.co.uk
Wildcards Critical
-
*.msgsvc.io
Wildcards Critical
-
*.operationstechnology.io
Wildcards Critical
-
*.paddypartners.com
Wildcards Critical
-
*.paddypower.com
Wildcards Critical
-
*.paddypower.it
Wildcards Critical
-
*.platformservices.io
Wildcards Critical
-
*.ppb.com
Wildcards Critical
-
*.ppbdev.com
Wildcards Critical
-
*.sbgcdn.com
Wildcards Critical
-
*.sbgcore.com
Wildcards Critical
-
*.sbgorigin.com
Wildcards Critical
-
*.sbgservices.com
Wildcards Critical
-
*.sbgtest.net
Wildcards Critical
-
*.securityservices.io
Wildcards Critical
-
*.skybet.co.uk
Wildcards Critical
-
*.skybet.com
Wildcards Critical
-
*.skybet.net
Wildcards Critical
-
*.skybetservices.com
Wildcards Critical
-
*.skybettest.net
Wildcards Critical
-
*.skybettingandgaming.com
Wildcards Critical
-
*.skybettingandgaming.design
Wildcards Critical
-
*.skybettingandgaming.info
Wildcards Critical
-
*.skybingo.com
Wildcards Critical
-
*.skycasino.com
Wildcards Critical
-
*.skygamingcontent.com
Wildcards Critical
-
*.skypoker.com
Wildcards Critical
-
*.skyvegas.com
Wildcards Critical
-
*.sportinglife.com
Wildcards Critical
-
itv7.itv.com
Web Critical
-
metrocompetitions.com
Web Critical
-
rafflee.co.uk
Web Critical
-
super6.skysports.com
Web Critical
-
https://play.google.com/store/apps/dev?id=5503565801970655430&gl=gb
Android Critical
-
https://play.google.com/store/apps/dev?id=8912907283039023448&gl=GB
Android Critical
-
https://play.google.com/store/apps/dev?id=9151483005769461618&gl=GB
Android Critical
-
https://play.google.com/store/apps/developer?id=Sky+Betting+and+Gaming+Apps&gl=uk
Android Critical
No target matches. Try part of a host name, such as the company name.
Out of scope 36
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
*.betfair.com.au
-
*.email.skybet.com
-
online.*.skybingo.com
-
*.s6.sbgservices.com
-
*.sbagmail.skybettingandgaming.com
-
*.sbg.life
-
*.sbga.me
-
*.sbgcolab.com
-
*.sbgdataintl.com
-
*.sbggraduates.com
-
*.sbgmail.skybettingandgaming.com
-
*.sbgpeople.com
-
*.sbpartner.it
-
*.skybet-it.info
-
*.skybet.de
-
*.skybet.it
-
*.skybetcareers.com
-
*.skybetchiusuraconto.it
-
*.skybetgraduates.com
-
*.skybetpartner.de
-
*.skybettingandgamingresearch.com
-
*.skybusinessemail.com
-
*.technology.skybettingandgaming.com
-
*.us.betfair.com
-
affiliatehub.skybet.com
-
community.betfair.com
-
community.skypoker.com
-
community.staging.skypoker.com
-
email1.skybet.com
-
partners.skybet.com
-
sbagmail.skybettingandgaming.com
-
skymail.sky.com
-
skyrgs.blueprintgaming.com
-
support.developer.betfair.com
-
technology.skybettingandgaming.com
-
www.betfair.com.co
Recent changes
Reward and scope changes across every Flutter UK & Ireland program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Flutter UK & Ireland products, from the NVD.
-
CVE-2026-27704 Medium
The Dart and Flutter SDKs provide software development kits for the Dart programming language. In versions of the Dart SDK prior to 3.11.0 and the Flutter SDK prior to version 3.41.0, when the pub client (`dart pub` and `flutter pub`) extracts a package in the pub cache, a malicious package archive can have files extracted outside the destination directory in the `PUB_CACHE`. A fix has been landed
-
CVE-2024-54462 Low
The file names constructed within image_picker are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select an image file from that provider while using your app and could potentially override internal files in your app cache. Issue patched in 0.8.12+18. It is recommended to up
-
CVE-2024-54461 Low
The file names constructed within file_selector are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select a document file from that provider while using your app and could potentially override internal files in your app cache. Issue patched in 0.5.1+12. It is recommended to
-
CVE-2022-3095 Critical
The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standards. Dart uses the RFC 3986 syntax, which creates incompatibilities with the '\' characters in URIs, which can lead to auth bypass in webapps interpreting URIs. We recommend updating Dart or Flutter to mitigate the issue.
About this page
This page gathers every public program listed under flutter.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.