- Top reward
- $5,000
- Top severity paid
- Critical
- Assets in scope
- 44
- Public CVEs
- 4
- Last change
At a glance
What to know before you start testing.
- Pays up to $5,000
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
- Replies within 4 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$5,000 |
| High |
|
$2,500 |
| Medium |
|
$600 |
| Low |
|
$250 |
- Response
-
Within 4 days
Time to triage - first line by HackerOne - 4 business days (process owned by HackerOne)
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
44 assets you may test, 36 excluded.
Wildcard domains 36
- *.betfair.com Critical
- *.betfair.es Critical
- *.betfair.it Critical
- *.betfair.ro Critical
- *.betfair.se Critical
- *.betsharedservices.io Critical
- *.betviewapi.com Critical
- *.dibz.co.uk Critical
- *.msgsvc.io Critical
- *.operationstechnology.io Critical
- *.paddypartners.com Critical
- *.paddypower.com Critical
- *.paddypower.it Critical
- *.platformservices.io Critical
- *.ppb.com Critical
- *.ppbdev.com Critical
- *.sbgcdn.com Critical
- *.sbgcore.com Critical
- *.sbgorigin.com Critical
- *.sbgservices.com Critical
- *.sbgtest.net Critical
- *.securityservices.io Critical
- *.skybet.com Critical
- *.skybet.co.uk Critical
- *.skybet.net Critical
- *.skybetservices.com Critical
- *.skybettest.net Critical
- *.skybettingandgaming.com Critical
- *.skybettingandgaming.design Critical
- *.skybettingandgaming.info Critical
- *.skybingo.com Critical
- *.skycasino.com Critical
- *.skygamingcontent.com Critical
- *.skypoker.com Critical
- *.skyvegas.com Critical
- *.sportinglife.com Critical
Android apps 4
- https://play.google.com/store/apps/developer?id=Sky+Betting+and+Gaming+Apps&gl=uk Critical
- https://play.google.com/store/apps/dev?id=5503565801970655430&gl=gb Critical
- https://play.google.com/store/apps/dev?id=8912907283039023448&gl=GB Critical
- https://play.google.com/store/apps/dev?id=9151483005769461618&gl=GB Critical
Web 4
- itv7.itv.com Critical
- metrocompetitions.com Critical
- rafflee.co.uk Critical
- super6.skysports.com Critical
Out of scope (36)
- affiliatehub.skybet.com
- community.betfair.com
- community.skypoker.com
- community.staging.skypoker.com
- email1.skybet.com
- partners.skybet.com
- sbagmail.skybettingandgaming.com
- skymail.sky.com
- skyrgs.blueprintgaming.com
- support.developer.betfair.com
- technology.skybettingandgaming.com
- www.betfair.com.co
- *.betfair.com.au
- *.email.skybet.com
- online.*.skybingo.com
- *.s6.sbgservices.com
- *.sbagmail.skybettingandgaming.com
- *.sbga.me
- *.sbgcolab.com
- *.sbgdataintl.com
- *.sbggraduates.com
- *.sbg.life
- *.sbgmail.skybettingandgaming.com
- *.sbgpeople.com
- *.sbpartner.it
- *.skybetcareers.com
- *.skybetchiusuraconto.it
- *.skybet.de
- *.skybetgraduates.com
- *.skybet.it
- *.skybet-it.info
- *.skybetpartner.de
- *.skybettingandgamingresearch.com
- *.skybusinessemail.com
- *.technology.skybettingandgaming.com
- *.us.betfair.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Flutter UK&I (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
You must use your own account (or a dedicated test account) for testing or research purposes.
-
Do not attempt to gain access to another user's account or confidential information.
-
Make a good faith effort to avoid privacy violations and destruction of data.
-
Only interact with accounts you own.
-
any operation that leads to the interruption or degradation of our services is explicitly forbidden.
-
Don't use common vulnerability scanners.
-
The search for vulnerabilities should be manual, although custom tools with automated requests are allowed if limited to 5 requests per second.
-
Social engineering (e.g. phishing, vishing, smishing) is prohibited.
-
Submit one vulnerability per report, unless you can chain vulnerabilities to increase impact.
-
Written permission from Flutter UK&I is required for the disclosure of any vulnerability found.
Not accepted
-
Credential leaks unless impact is proved.
-
WordPress issues without real impact such as user enumeration and the presence of Xmlrpc.php
-
Attacks requiring MitM or physical access to a user's device (e.g. lack of TLS protection on non-sensitive HTTP communication, etc.).
-
Flash based client-side vulnerabilities such as Flash XSS, Flash Open Redirect or Flash Content Injection.
-
Any activity that could lead to the disruption of our service (DoS, DDoS).
-
Vulnerabilities with a CVE ID published less than 24 hours prior to the report submission
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 18 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
metrocompetitions.com
-
Rules updated
Added: “Vulnerabilities that affect Metro (metrocompetitions.com) and Rafflee (rafflee.co.uk) will be awarded with only one bounty; only the first report will be consid...”
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-27704 | The Dart and Flutter SDKs provide software development kits for the Dart programming language. In versions of the Dart SDK prior to 3.11.0 and the Flutter SDK prior to version 3.41.0, when the pub client (`dart pub` and `flutter pub`) extracts a package in the pub cache, a malicious package archive can have files extracted outside the destination directory in the `PUB_CACHE`. A fix has been landed | Medium 6.6 | 25 Feb 2026 |
| CVE-2024-54462 | The file names constructed within image_picker are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select an image file from that provider while using your app and could potentially override internal files in your app cache. Issue patched in 0.8.12+18. It is recommended to up | Low 2.1 | 29 Jan 2025 |
| CVE-2024-54461 | The file names constructed within file_selector are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select a document file from that provider while using your app and could potentially override internal files in your app cache. Issue patched in 0.5.1+12. It is recommended to | Low 2.1 | 29 Jan 2025 |
| CVE-2022-3095 | The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standards. Dart uses the RFC 3986 syntax, which creates incompatibilities with the '\' characters in URIs, which can lead to auth bypass in webapps interpreting URIs. We recommend updating Dart or Flutter to mitigate the issue. | Critical 9.8 | 27 Oct 2022 |
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Flutter UK & Ireland looks forward to work with the security community to find vulnerabilities in our brands to keep our businesses and customers safe. The only brands in scope of this program are Betfair, Paddy Power and Sky Betting and Gaming. Please carefully review the scope section for more details.
SLA
Flutter UK & Ireland will make a best effort to meet the following SLAs for hackers participating in our program:
- Time to triage - first line by HackerOne - 4 business days (process owned by HackerOne)
- Time to triage - second line by Flutter UKI - 2 business days after report is triaged by HackerOne
- Time to bounty - 2 business days after report is triaged by Flutter UKI
We’ll keep you informed about your reports’ state throughout the process.
Recommendations
- usage of an IP address from UK or Ireland to prevent geo-blocks
- usage of identifiers that help to determine you are a security researcher, in logs and account details (e.g. HackerOne email alias)
Responsible Disclosure & Credit
- Follow HackerOne's disclosure guidelines.
- Any information you receive or collect about us, our affiliates, users, employees or agents must be kept confidential. It’s strictly prohibited to use, disclose or distribute any such information.
- Written permission from Flutter UK&I is required for the disclosure of any vulnerability found. Disclosure requests must be submitted through the HackerOne platform.
Program Rules
- You must be 18 years of age or older and meet the other eligibility and verification criteria to use our services, as outlined in our General Terms & Conditions available at https://support.skybet.com/s/article/Sky-Betting-and-Gaming-General-Terms-Conditions , https://www.betfair.com/aboutUs/Terms.and.Conditions/ and https://www.paddypower.com/aboutUs/Terms.and.Conditions/.
- In connection with your participation in this program you agree to comply with all applicable local and national laws.
- You must use your own account (or a dedicated test account) for testing or research purposes. Do not attempt to gain access to another user's account or confidential information. To prove cross-user account access both accounts must be registered to yourself.
- Make a good faith effort to avoid privacy violations and destruction of data. Only interact with accounts you own. Also, any operation that leads to the interruption or degradation of our services is explicitly forbidden.
- Don't use common vulnerability scanners. The search for vulnerabilities should be manual, although custom tools with automated requests are allowed if limited to 5 requests per second.
- Minimize the mayhem. For instance, when testing for a command injection vulnerability, it is sufficient to show the output of the id or hostname commands, and you should stop the exploitation at this point.
- Social engineering (e.g. phishing, vishing, smishing) is prohibited.
- Provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue it won’t be eligible for a reward.
- Submit one vulnerability per report, unless you can chain vulnerabilities to increase impact.
- When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
- Multiple vulnerabilities caused by one underlying issue will be awarded with only one bounty (e.g. multiple domains that point to the same component, general caching vulnerabilities, etc.). Only the first report will be valid, the other reports will be closed as duplicates.
ATTENTION, when analysing applications that are hosted by Cloud Service Providers (CSPs), carefully read and always oblige to the CSP Rules Of Engagement (ROE). Examples:
- ROE for AWS: https://aws.amazon.com/security/penetration-testing/
- ROE for Azure: https://www.microsoft.com/en-us/msrc/pentest-rules-of-engagement
- ROE for Google Cloud: https://cloud.google.com/security/overview/ (these are just examples, always identify the CSP and follow its Rules of Engagement)
Out of scope vulnerabilities
The following issues are considered out of scope and won’t be eligible for a bounty:
- Security issues/best practices that can’t be exploited with real impact (e.g. outdated service, missing cookie flags, clickjacking/CSRF on endpoints with no sensitive actions/data, lack of DKIM/DMARC/SPF, etc.). All reports require a working PoC exploit to be considered valid. For example, a lack of bruteforce protection report requires a PoC with your own account where the password is successfully guessed after 100 failed attempts (using a wordlist with 100 random words before your own testing password).
- Credential leaks unless impact is proved. Note that it's illegal (and forbidden) to attempt to login to customer accounts.
- WordPress issues without real impact such as user enumeration and the presence of Xmlrpc.php (https://make.wordpress.org/core/handbook/testing/reporting-security-vulnerabilities/#why-are-disclosures-of-usernames-or-user-ids-not-a-security-issue).
- Attacks requiring MitM or physical access to a user's device (e.g. lack of TLS protection on non-sensitive HTTP communication, etc.).
- Flash based client-side vulnerabilities such as Flash XSS, Flash Open Redirect or Flash Content Injection.
- Any activity that could lead to the disruption of our service (DoS, DDoS).
- Vulnerabilities with a CVE ID published less than 24 hours prior to the report submission
- Vulnerabilities that affect Metro (metrocompetitions.com) and Rafflee (rafflee.co.uk) will be awarded with only one bounty; only the first report will be considered valid and we will close other reports as duplicate; the reason for this is that the mitigation will be a single code/configuration change that will affect both products.
Thank you for helping keep Flutter UK&I and our users safe!