NBA Public Bug Bounty
By National Basketball Association (NBA) Bug bounty on HackerOne nba.com
- Top reward
- $6,000
- Top severity paid
- Critical
- Assets in scope
- 460
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $6,000
- for critical bugs.
- Report through their form
- hackerone.com/nba-public
- Replies within 5 days
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$6,000 from $3,000 |
| High |
|
$3,000 from $1,500 |
| Medium |
|
$500 from $300 |
- Response
-
Within 5 days
First Response | 5 Days
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
460 assets you may test, 29 excluded.
Web 458
- aces-dev.wnba.com Critical
- aces-qa2.wnba.com Critical
- aces-qa.wnba.com Critical
- aces.wnba.com Critical
- adb.nba.com Critical
- aguacaliente-dev.gleague.nba.com Critical
- aguacaliente.gleague.nba.com Critical
- aguacaliente-qa.gleague.nba.com Critical
- ak-static-dev.nba.com Critical
- allstar-dev.nba.com Critical
- amp-nba-dev.nba.com Critical
- amp-nba.nba.com Critical
- amp-nba-stage.nba.com Critical
- api.nba.com Critical
- austin-dev.gleague.nba.com Critical
- austin.gleague.nba.com Critical
- austin-qa.gleague.nba.com Critical
- auth-identity-dev.nba.com Critical
- auth-identity-dev-ping.nba.com Critical
- auth-identity.nba.com Critical
- auth-identity-ping.nba.com Critical
- auth-identity-qa.nba.com Critical
- auth-identity-qa-ping.nba.com Critical
- auth-identity-uat.nba.com Critical
- auth-identity-uat-ping.nba.com Critical
- bakersfield.gleague.nba.com Critical
- bakersfield-qa.gleague.nba.com Critical
- bal-dev.nba.com Critical
- bal.nba.com Critical
- bal-qa.nba.com Critical
- bal-uat.nba.com Critical
- bealegend.nba.com Critical
- birmingham-dev.gleague.nba.com Critical
- birmingham.gleague.nba.com Critical
- birmingham-qa.gleague.nba.com Critical
- bluecoats.gleague.nba.com Critical
- bluecoats-qa.gleague.nba.com Critical
- br.nba.com Critical
- canton-dev.gleague.nba.com Critical
- canton.gleague.nba.com Critical
- canton-qa.gleague.nba.com Critical
- capitalcity-dev.gleague.nba.com Critical
- capitalcity.gleague.nba.com Critical
- capitalcity-qa.gleague.nba.com Critical
- capitanes-dev.gleague.nba.com Critical
- capitanes.gleague.nba.com Critical
- capitanes-qa.gleague.nba.com Critical
- cares-dev.nba.com Critical
- cares.nba.com Critical
- cares-qa.nba.com Critical
- cdn-bal-dev.nba.com Critical
- cdn-bal.nba.com Critical
- cdn-bal-qa.nba.com Critical
- cdn-bal-uat.nba.com Critical
- cdn-dev.nba.com Critical
- cdn-gleague-dev.nba.com Critical
- cdn-gleague.nba.com Critical
- cdn.gleague.nba.com Critical
- cdn-gleague-qa.nba.com Critical
- cdn.nba.com Critical
- cdn-qa.gleague.nba.com Critical
- cdn-qa.nba.com Critical
- cdn-uat.gleague.nba.com Critical
- cdn-uat.nba.com Critical
- cleveland-dev.gleague.nba.com Critical
- cleveland.gleague.nba.com Critical
- cleveland-qa.gleague.nba.com Critical
- cl.nba.com Critical
- cl-qa.nba.com Critical
- coachellavalley-dev.gleague.nba.com Critical
- coachellavalley.gleague.nba.com Critical
- coachellavalley-qa.gleague.nba.com Critical
- coalition-dev.nba.com Critical
- coalition-qa.nba.com Critical
- comets-dev.wnba.com Critical
- comets-qa.wnba.com Critical
- comets-uat.wnba.com Critical
- comets.wnba.com Critical
- communityassist.nba.com Critical
- contact-dev.nba.com Critical
- contact.nba.com Critical
- contact-qa.nba.com Critical
- content-api-dev.nba.com Critical
- content-api-nextgen-dev.nba.com Critical
- content-api-nextgen-prod.nba.com Critical
- content-api-nextgen-qa.nba.com Critical
- content-api-nextgen-uat.nba.com Critical
- content-api-prod.nba.com Critical
- content-api-qa.nba.com Critical
- content-api-sandbox.nba.com Critical
- content-api-uat.nba.com Critical
- core-api-aws-dev.nba.com Critical
- core-api-aws-prod-east1.nba.com Critical
- core-api-aws-prod.nba.com Critical
- core-api-aws-qa.nba.com Critical
- core-api-aws-uat.nba.com Critical
- core-api-devint.nba.com Critical
- core-api-dev.nba.com Critical
- core-api.nba.com Critical
- core-api-qa.nba.com Critical
- core-api-sandbox.nba.com Critical
- core-api-uat.nba.com Critical
- core-api-uat-uc.nba.com Critical
- core-api-uc.nba.com Critical
- coronavirus.nba.com Critical
- corp-dev.nba.com Critical
- corp.nba.com Critical
- courtside.nba.com Critical
- cpskyhawks-dev.gleague.nba.com Critical
- cpskyhawks.gleague.nba.com Critical
- cpskyhawks-qa.gleague.nba.com Critical
- cweb-ott-aws-qa.nba.com Critical
- cweb-ott-aws-uat.nba.com Critical
- cweb-ott-aws-uat-uw2.nba.com Critical
- cweb-ott-dev-aws.nba.com Critical
- cweb-ott-devint.nba.com Critical
- cweb-ott-dev.nba.com Critical
- cweb-ott-dev-preview.nba.com Critical
- cweb-ott.nba.com Critical
- cweb-ott-preview.nba.com Critical
- cweb-ott-qa-aws.nba.com Critical
- cweb-ott-qa.nba.com Critical
- cweb-ott-qa-preview.nba.com Critical
- cweb-ott-uat.nba.com Critical
- cweb-ott-uat-preview.nba.com Critical
- cweb-ott-uat-uc.nba.com Critical
- cweb-ott-uat-uc-preview.nba.com Critical
- cweb-ott-uc.nba.com Critical
- cweb-ott-uc-preview.nba.com Critical
- cweb-ott-wnba-dev.nba.com Critical
- cweb-ott-wnba.nba.com Critical
- cweb-ott-wnba-qa.nba.com Critical
- cweb-qa-aws-preview.nba.com Critical
- cweb-slot1-ott-dev.nba.com Critical
- cweb-slot2-ott-dev.nba.com Critical
- cweb-slot3-ott-dev.nba.com Critical
- cweb-slot4-ott-dev.nba.com Critical
- cweb-slot5-ott-dev.nba.com Critical
- cweb-slot6-ott-dev.nba.com Critical
- cweb-slot6-preview-ott-dev.nba.com Critical
- data-test.nba.com Critical
- delaware-dev.gleague.nba.com Critical
- delaware.gleague.nba.com Critical
- delaware-qa.gleague.nba.com Critical
- detroit-dev.gleague.nba.com Critical
- detroit.gleague.nba.com Critical
- detroit-qa.gleague.nba.com Critical
- dev.courtside.nba.com Critical
- dev.stats.gleague.nba.com Critical
- dev.stats.nba.com Critical
- dev.stats.wnba.com Critical
- dream-dev.wnba.com Critical
- dream-qa2.wnba.com Critical
- dream-qa.wnba.com Critical
- dream.wnba.com Critical
- dwhreports.nba.com Critical
- ec2-redirect-west.nba.com Critical
- ec2redirect-west.nba.com Critical
- elm.nba.com Critical
- erie-dev.gleague.nba.com Critical
- erie.gleague.nba.com Critical
- erie-qa.gleague.nba.com Critical
- fever-dev.wnba.com Critical
- fever-qa2.wnba.com Critical
- fever-qa.wnba.com Critical
- fever.wnba.com Critical
- fire-dev.wnba.com Critical
- fire-qa.wnba.com Critical
- fire.wnba.com Critical
- fit.nba.com Critical
- fortwayne-dev.gleague.nba.com Critical
- fortwayne.gleague.nba.com Critical
- fortwayne-qa.gleague.nba.com Critical
- gamenotes.nba.com Critical
- gatoradetrainingcenter.nba.com Critical
- gldatacenter.nba.com Critical
- gleague-dev.nba.com Critical
- gleague.nba.com Critical
- gleague-qa.nba.com Critical
- globalstores-dev.nba.com Critical
- globalstores.nba.com Critical
- globalstores-qa.nba.com Critical
- gms.nba.com Critical
- gms-prev.nba.com Critical
- grae.nba.com Critical
- grandrapids-dev.gleague.nba.com Critical
- grandrapids.gleague.nba.com Critical
- grandrapids-qa.gleague.nba.com Critical
- green.nba.com Critical
- greensboro-dev.gleague.nba.com Critical
- greensboro.gleague.nba.com Critical
- greensboro-qa.gleague.nba.com Critical
- hoop.nba.com Critical
- hoopsfortroops.nba.com Critical
- huddle.nba.com Critical
- identity-dev.nba.com Critical
- identity.nba.com Critical
- identity-ng.nba.com Critical
- identity-ping.nba.com Critical
- identity-qa.nba.com Critical
- And 258 more on HackerOne.
Android apps 1
- com.nbaimd.gametime.nba2011 Critical
iOS apps 1
- com.nbaimd.gametime.universal Critical
Out of scope (29)
- 2kleague-dev.nba.com
- 2kleague.nba.com
- 2kleague-qa.nba.com
- ak-static.cms-dev.nba.com
- ak-static.cms.nba.com
- ak-static.cms-qa.nba.com
- arcade.nba.com
- brand.nba.com
- cms-dev.nba.com
- cms-int.nba.com
- cms.nba.com
- cms-qa.nba.com
- coalition.nba.com
- dev.stats.2kleague.nba.com
- events.bal.nba.com
- evergent.com
- games.nbaacademy.nba.com
- jr.nba.com
- leaguepass.wnba.com
- login-sandbox.nba.com
- mediacentral.nba.com
- mindhealth.nba.com
- nbafoundation-dev.nba.com
- nbafoundation.nba.com
- nbafoundation-qa.nba.com
- payment.nba.com
- smm.events.nba.com
- stats.2kleague.nba.com
- totalhealth.nba.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from NBA Public Bug Bounty (via HackerOne)'s policy.
While testing
-
Traffic requests must not exceed 3 requests per second, as this will help with the observability and monitoring of external testing.
-
Do not perform attacks that can lead to denial of service (DoS/DDoS).
-
Do not perform social engineering, brute-forcing, or password spraying attacks.
-
Do not perform testing on out-of-scope assets or vulnerabilities.
-
Do not perform aggressive vulnerability scans.
-
Do not modify any files or destroy data, including permissions.
-
Do not access NBA customer, employee, or confidential information.
-
Do not intentionally view or access any data beyond what is needed to prove the vulnerability.
-
Do not degrade the NBA user experience. Security testing must not disrupt production or lower environment systems.
-
Stop testing and report the finding to the NBA immediately if you obtain unauthorized access to sensitive data, compromised accounts, or discover arbitrary command execution.
Not accepted
-
Denial of Service (DoS) or Distributed Denial of Service (DDoS)
-
Cache Poisoning
-
HTTP Request Smuggling
-
Client-Side Desync
-
Edge Side Includes (ESI) Injection
-
Server Information & Status Pages
-
SSL/TLS Best Practices
-
Reports from automated tools or scans
-
Social Engineering
-
Vulnerabilities on out-of-scope assets
-
Verbose error messages without proof of exploitability
-
Issues without a clearly defined security impact
-
Self-exploitation
-
Brute Forcing
-
Password Spraying
-
Banner Grabbing
-
Absence of SPF/DMARC records
-
NBA ID fan account credentials
-
Contact form scanning
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
comets-uat.wnba.com
-
Scope added
cweb-ott-uat.nba.com
-
Scope added
cweb-ott-wnba.nba.com
-
Scope added
cweb-ott-wnba-qa.nba.com
-
Scope added
cweb-ott-wnba-dev.nba.com
-
Scope added
lineemup-dev.wnba.com
-
Scope added
login.wnba.com
-
Scope added
playbook.wnba.com
-
Scope added
identity.wnba.com
-
Scope added
login-uat.wnba.com
-
Scope added
comets-qa.wnba.com
-
Scope added
login-dev.wnba.com
-
Scope added
lineemup.wnba.com
-
Scope added
comets-dev.wnba.com
-
Scope added
login-qa.wnba.com
-
Scope added
pata.wnba.com
-
Scope added
dev.stats.wnba.com
-
Scope added
tue.wnba.com
-
Scope added
comets.wnba.com
-
Scope added
sandiego.gleague.nba.com
-
Scope added
osceola.gleague.nba.com
-
Scope added
osceola-qa.gleague.nba.com
-
Scope added
laketown-dev.gleague.nba.com
-
Scope added
coachellavalley.gleague.nba.com
-
Scope added
coachellavalley-qa.gleague.nba.com
-
Scope added
laketown.gleague.nba.com
-
Scope added
coachellavalley-dev.gleague.nba.com
-
Scope added
cleveland-qa.gleague.nba.com
-
Scope added
cleveland-dev.gleague.nba.com
-
Scope added
valley-qa.gleague.nba.com
-
Scope added
laketown-qa.gleague.nba.com
-
Scope added
valley.gleague.nba.com
-
Scope added
brand.nba.com (out of scope)
-
Scope added
cms-int.nba.com (out of scope)
-
Scope added
cms-dev.nba.com (out of scope)
-
Scope added
cms-qa.nba.com (out of scope)
-
Scope added
games.nbaacademy.nba.com (out of scope)
-
Scope added
data-test.nba.com
-
Scope added
official-qa.nba.com
-
Scope added
official-dev.nba.com
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
- Purpose
- Scope
- Rules of Engagement
- In-Scope Vulnerabilities
- Out of Scope Vulnerabilities
- Make Your Submission Count
- Reward Structure
- Response Targets
- Disclosure Policy
- Compliance
- References
Purpose
The National Basketball Association (NBA) is a global sports and media organization, built around five professional sports leagues: the NBA, WNBA, NBA G League, NBA 2K League and Basketball Africa League. The NBA has a major international presence with games and programming available in 214 countries and territories in 60 languages. At the NBA, we’re passionate about growing and celebrating the game of basketball. The NBA's mission is centered around igniting inspiration and fostering connections among people worldwide through the transformative power of basketball. With the intensity of the game and incredible athleticism of our players, the NBA delivers excitement to hundreds of millions of fans worldwide. In addition to the league's on-court activities, the NBA manages relationships with television and digital media partners, develops marketing partnerships with some of the world's most recognizable companies, oversees the licensing of merchandise, and manages a wide range of global events that attract fans and drive social impact in communities around the world.
This policy defines the requirements for security researchers to conduct vulnerability discovery activities and submit identified findings through HackerOne for a potential bounty reward. You must have a HackerOne account and use the HackerOne platform for all submissions. Participating in the NBA’s bug bounty program is a unique opportunity to earn bounty payouts while helping to enhance the security of our applications. The NBA has been working closely with the security research community for more than six years through responsible disclosure and private bug bounty programs. Thanks to your contributions, the NBA continues to drive innovation through technology, captivate fans around the globe, and safeguard our brand. We greatly value the positive impact of your work to improve the security of the NBA.
Scope
The NBA has a vast infrastructure within the public domain. However, not all digital assets are in-scope for the NBA bug bounty program. Researchers are strictly prohibited from any security testing on applications that are not in-scope. Security testing on out-of-scope assets, vulnerabilities, and/or any actions that are otherwise in violation of the requirements stated are not eligible for bounty reward. All security researchers participating in the program must adhere to the scope requirements. The list of in-scope assets can be found here.
Rules of Engagement
- Be mindful of your testing activities to avoid initiating any actions that could potentially lead to denial of service. Traffic requests must not exceed 3 requests per second, as this will help with the observability and monitoring of external testing. Failure to do so will be considered a denial-of-service (DoS) attack.
- Do not perform attacks that can lead to denial of service (DoS/DDoS).
- Do not perform social engineering, brute-forcing, or password spraying attacks.
- Do not perform testing on out-of-scope assets or vulnerabilities.
- Do not perform aggressive vulnerability scans.
- Do not modify any files or destroy data, including permissions.
- Do not access NBA customer, employee, or confidential information.
- Do not intentionally view or access any data beyond what is needed to prove the vulnerability.
- Do not degrade the NBA user experience. Security testing must not disrupt production or lower environment systems.
- Stop testing and report the finding to the NBA immediately if you obtain unauthorized access to sensitive data, compromised accounts, or discover arbitrary command execution.
In-Scope Vulnerabilities
The NBA has adopted the OWASP Top 10 framework to ensure our web applications are security-hardened against top relevant risks and vulnerabilities. Our analysis will consider the information security triad: confidentiality, integrity, and availability with the lens of business risk and sensitive data exposure to determine a finding’s severity. The list below outlines vulnerability types that are in scope for bounty payout.
- Broken Access Control
- Remote Code Execution (RCE)
- Injection
- Insecure Design
- Security Misconfiguration
- Account Takeover (ATO)
- Vulnerable and Outdated Components
- Identification and Authentication Failures
- Software and Data Integrity Failures
- Server-Side Request Forgery (SSRF)
- Cross-Site Scripting (XSS)
- Cryptographic Failures
Out of Scope Vulnerabilities
The following vulnerability types are out of scope and not accepted by the NBA. Note: Zero-day vulnerabilities may be reported 30 days after initial publication.
- Denial of Service (DoS) or Distributed Denial of Service (DDoS)
- Cache Poisoning
- HTTP Request Smuggling
- Client-Side Desync
- Edge Side Includes (ESI) Injection
- Server Information & Status Pages
- SSL/TLS Best Practices
- Reports from automated tools or scans
- Social Engineering
- Vulnerabilities on out-of-scope assets
- Verbose error messages without proof of exploitability
- Issues without a clearly defined security impact
- Self-exploitation
- Brute Forcing
- Password Spraying
- Banner Grabbing
- Absence of SPF/DMARC records
- NBA ID fan account credentials
- Contact form scanning
Make Your Submission Count
- Acceptance or rejection of all vulnerability report submissions is subject to the NBA’s sole discretion.
- Detailed reports must be provided. Reports without a working proof of concept and steps to reproduce the finding will have the disposition status changed to "Needs more information."
- Proof of concepts are required to obtain the full bounty payment. If a proof of concept cannot be provided, justification by the researcher must be included.
- When duplicates occur, only the first received report will be awarded provided it can be fully reproduced in a form acceptable to the NBA.
- Exposed or compromised credentials will be evaluated on a case-by-case basis and paid out according to risk and impact to the NBA.
- Vulnerabilities will be consolidated into a single report and bounty payout if internal review determines that separate fixes are not warranted. This includes multiple reports submitted by a researcher for the same vulnerability found on various endpoints of the same host application or its components impacting multiple hosts.
Reward Structure
The NBA has aligned with CVSS v3.1 and places significant emphasis on the risk and impact resulting from a vulnerability for the reward conclusion. Bounty payments and severity classification are determined at the sole discretion of the NBA program administrator. All testing performed must comply with this program’s policy, rules of engagement, and scope for a report to be eligible for bounty reward. The vulnerability severity classification will generally be categorized according to the following criteria:
Medium Severity Vulnerability
Medium severity vulnerabilities pose a moderate risk to the NBA. Vulnerability examples include exposure of API tokens, reflected or DOM cross-site scripting with access to cookies, takeover on an unused subdomain, or read access to sensitive data or fields.
High Severity Vulnerability
High severity vulnerabilities are where exposure to the NBA starts to elevate. For example, read privileges to databases with sensitive PII, ability to scan internal network resources, domain takeover on an active web application, or improper access control.
Critical Severity Vulnerability
Critical severity vulnerabilities warrant immediate attention, and the proof of concept needs to demonstrate the exploitability and risk to the NBA. Examples include arbitrary command execution on a remote device, bulk sensitive data loss, or write access with full permissions to a database containing sensitive PII.
Response Targets
The NBA will use reasonable efforts to meet the following response targets for researchers participating in the program.
| Response Target | Time (Business Days) |
|---|---|
| First Response | 5 Days |
| Triage | 10 Days |
| Resolution | Dependent on severity & complexity |
Disclosure Policy
This program does not allow any disclosure without the NBA’s prior written approval in each instance and all researchers participating in the NBA public bug bounty program must adhere to this disclosure policy. Approval may be granted or withheld at the NBA’s sole discretion. Additionally, the NBA may require redactions to any authorized disclosure. Researchers must not discuss or release to the public any information about vulnerabilities (even if resolved) found in connection with this program, except and to the extent expressly permitted by the NBA. Approvals must be obtained from the NBA program administrator and requested within the HackerOne report submitted prior to any public disclosure.
The NBA strictly prohibits public disclosure and/or storage of data discovered during any testing activities. All data must be secured at-rest, in-transit, and in-storage to assure the confidentiality of sensitive or other protected information. All data collected, downloaded, cached or otherwise stored by researchers during testing activities, including any data entered or stored in third-party applications or services, must be promptly and securely deleted after submission of the report.
Compliance
Adherence to the NBA bug bounty program policy is required. Lack of compliance by security researchers is subject to the processes defined within the HackerOne Code of Conduct.
References
| Document Title | Document Description | Document URL |
|---|---|---|
| NBA Bug Bounty Program Policy | Documents the policy and rules of engagement for the program. | https://hackerone.com/nba-public |
| NBA Asset Scope | Defines in-scope assets for testing within the program. | https://hackerone.com/nba-public/policy_scopes |
| HackerOne Code of Conduct Policy | Code of Conduct policy and process from HackerOne. | https://www.hackerone.com/policies/code-of-conduct |
| HackerOne Safe Harbor | Golden Standard Safe Harbor (GSSH) policy from HackerOne. | https://hackerone.com/security/safe_harbor |
| CVSS 3.1 | Common Vulnerability Scoring System (CVSS) framework. | https://nvd.nist.gov/vuln-metrics/cvss |
| OWASP Top 10 | OWASP Top 10 vulnerabilities reference standard. | https://owasp.org/www-project-top-ten/ |