- Top reward
- $2,000
- Top severity paid
- Not published
- Assets in scope
- 59
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $2,000
- top reward.
- Report by email
- https://www.livesport.eu/en/contacts
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$2,000
15 points and up to $ 2,000
- Hall of fame
-
Yes
Hall of fame
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
59 assets you may test.
Domains 54
- diretta.it
- eredmenyek.com
- flashfootball.com
- flashscore.at
- flashscore.bg
- flashscore.ca
- flashscore.cl
- flashscore.co
- flashscore.co.id
- flashscore.co.ke
- flashscore.co.kr
- flashscore.com
- flashscore.com.ar
- flashscore.com.au
- flashscore.com.br
- flashscore.com.gh
- flashscore.com.mx
- flashscore.com.ng
- flashscore.com.tr
- flashscore.com.ua
- flashscore.com.ve
- flashscore.co.uk
- flashscore.co.za
- flashscore.de
- flashscore.dk
- flashscore.es
- flashscore.fi
- flashscore.fr
- flashscore.ge
- flashscore.gr
- flashscore.info
- flashscore.it
- flashscorekz.com
- flashscore.nl
- flashscore.pe
- flashscore.ph
- flashscore.pl
- flashscore.pt
- flashscore.ro
- flashscore.si
- flashscore.sk
- flashscore.ua
- flashscoreusa.com
- flashscore.vn
- livescore.in
- livesport.com
- livesport.cz
- liveticker.com
- rezultati.com
- soccer24.com
- soccerway.com
- tennis24.com
- tribalfootball.com
- wyniki.pl
Android apps 3
- Android
- Android Plus
- Huawei
iOS apps 1
- iOS
Products and areas 1
- KaiOS
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Livesport's policy. "We" in these lines means the program, not this site.
While testing
-
Reports that do not include proof-of-concept exploitation of vulnerabilities and the ability to access sensitive user, third party or Livesport group data
-
Attacks requiring physical access to a user's device
-
Any physical attacks on Livesport's datacenter infrastructure or assets
-
Attacks on employees or contractors using social engineering techniques
-
Reporting of non-existent links on our websites that point to Livesport Group domains
-
Attacks that may cause a Denial of Service (DoS) on Livesport Group websites and applications at the application or network layer
-
Creating duplicate user accounts or accounts without verifying the actual ownership of the email address
-
Any form of "non-authenticated" clickjacking or tapjacking
-
Any security reports from automated tools
-
XSS that are not stored
Not accepted
-
Reports that do not include proof-of-concept exploitation of vulnerabilities and the ability to access sensitive user, third party or Livesport group data
-
Attacks requiring physical access to a user's device
-
Any physical attacks on Livesport's datacenter infrastructure or assets
-
Attacks on employees or contractors using social engineering techniques
-
Reporting of non-existent links on our websites that point to Livesport Group domains
-
Attacks that may cause a Denial of Service (DoS) on Livesport Group websites and applications at the application or network layer
-
Creating duplicate user accounts or accounts without verifying the actual ownership of the email address
-
Any form of "non-authenticated" clickjacking or tapjacking
-
Any security reports from automated tools
-
XSS that are not stored
-
Any reports of insufficiently secure SSL/TLS ciphers without functional proof-of-concept abuse- against production infrastructure
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 2 hours ago.
-
Scope +
Added to scope: flashscore.ca
-
Scope +
Added to scope: tribalfootball.com
-
Scope +
Added to scope: wyniki.pl
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.