Penn Entertainment
Vulnerability disclosure program on HackerOne pennentertainment.com
- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 11
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 5 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Response
-
Within 5 days
We will acknowledge receipt of your report within 5 business days.
- Safe harbor
-
Full
Activities conducted in accordance with this policy will be considered authorized conduct, and we will not initiate legal action against you.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
11 assets you may test, 5 excluded.
Web 7
- about.thescore.bet Critical No bounty
- hollywoodcasino.com Critical No bounty
- pennentertainment.com Critical No bounty
- pennplaycasino.com Critical No bounty
- thescore.bet Critical No bounty
- thescore.com Critical No bounty
- thescoreesports.com Critical No bounty
iOS apps 2
- 285692706 Critical No bounty
- 6463805689 Critical No bounty
Android apps 1
- com.fivemobile.thescore Critical No bounty
Wildcard domains 1
- *.thescore.com Critical No bounty
Out of scope (5)
- com.espn.bet
- about.espnbet.com
- campaignmanager.thescore.com
- espnbet.com
- *.pgs.casino
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Penn Entertainment (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Conduct research in a manner that avoids privacy violations and service disruptions.
-
Give us a reasonable period to address the vulnerability before making any public disclosures.
-
Do not access or modify data beyond what is necessary to demonstrate the vulnerability.
-
Do not disclose vulnerability details to third parties without our express written consent.
Not accepted
-
Reports without a working proof-of-concept or clear reproducible steps.
-
Findings from automated scans without manual verification.
-
Clickjacking on pages with no sensitive actions.
-
Missing security headers that do not lead to direct exploitation.
-
Denial of Service attacks.
-
Social engineering or phishing attacks.
-
Physical security issues.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
*.pgs.casino (out of scope)
-
Scope added
about.espnbet.com (out of scope)
-
Scope added
campaignmanager.thescore.com (out of scope)
-
Scope added
com.espn.bet (out of scope)
-
Scope added
espnbet.com (out of scope)
-
Scope added
*.thescore.com
-
Scope added
285692706
-
Scope added
6463805689
-
Scope added
about.thescore.bet
-
Scope added
com.fivemobile.thescore
-
Scope added
hollywoodcasino.com
-
Scope added
pennentertainment.com
-
Scope added
pennplaycasino.com
-
Scope added
thescore.bet
-
Scope added
thescore.com
-
Scope added
thescoreesports.com
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Our Commitment to Security
At Penn Entertainment, we are dedicated to maintaining the highest standards of security across all our digital assets. Our information security team works tirelessly to protect our systems, services, and the confidentiality of our customers' information. We recognize the invaluable role that security researchers play in helping us identify and address potential vulnerabilities. We welcome the opportunity to collaborate with the research community to enhance our security posture.
About the Program
Our Vulnerability Disclosure Program (VDP) invites security researchers to responsibly discover and report vulnerabilities that could compromise the integrity, availability, or confidentiality of Penn Entertainment's products, services, or information technology infrastructure. We encourage you to report any findings in accordance with the guidelines outlined below.
Scope of the Program
In-Scope Assets
All public-facing assets owned, operated, or controlled by Penn Entertainment are within the scope of this program. This includes, but is not limited to:
- Websites
- Web Applications and APIs
- Mobile Applications
- Online Gaming Platforms
Qualifying Vulnerabilities
We are interested in receiving reports on vulnerabilities that have a significant security impact, such as:
- Cross-Site Scripting (XSS)
- Cross-Site Request Forgery (CSRF)
- SQL Injection
- Authentication and Authorization Flaws
- Remote Code Execution
- Privilege Escalation
- Insecure Direct Object References
- Sensitive Data Exposure
- Server-Side Request Forgery (SSRF)
- Security Misconfigurations
Out-of-Scope Assets and Vulnerabilities
The following are generally outside the scope of our program:
Out-of-Scope Assets: Internal systems, third-party services, or assets not owned by Penn Entertainment.
#Non-Qualifying Vulnerabilities:
- Reports without a working proof-of-concept or clear reproducible steps.
- Findings from automated scans without manual verification.
- Clickjacking on pages with no sensitive actions.
- Missing security headers that do not lead to direct exploitation.
- Denial of Service attacks.
- Social engineering or phishing attacks.
- Physical security issues.
Responsible Disclosure Policy
We ask that researchers:
- Act in Good Faith: Conduct research in a manner that avoids privacy violations and service disruptions.
- Allow Time for Remediation: Give us a reasonable period to address the vulnerability before making any public disclosures.
- Avoid Data Access: Do not access or modify data beyond what is necessary to demonstrate the vulnerability.
- Maintain Confidentiality: Do not disclose vulnerability details to third parties without our express written consent.
Legal Safe Harbor
Activities conducted in accordance with this policy will be considered authorized conduct, and we will not initiate legal action against you. If legal action is initiated by a third party, we will make it known that your actions were conducted in compliance with this policy.
Our Commitment to You
Prompt Acknowledgment: We will acknowledge receipt of your report within 5 business days. Transparency: We will keep you informed of the progress towards resolving the issue. Confidentiality: We will not share your personal information without your permission.