- Top reward
- $49,999
- Top severity paid
- Critical
- Assets in scope
- 24
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $49,999
- for high bugs.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$10,000 from $5,000 |
| High |
|
$49,999 from $3,000 |
| Medium |
|
$9,999 from $800 |
| Low |
|
$2,499 from $250 |
- Safe harbor
-
Full
We will not initiate legal action or a complaint against you for accidental, good faith violations of this policy
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
24 assets you may test.
Web 16
- api.direct.playstation.com Critical
- ca.account.sony.com Critical
- checkout.playstation.com Critical
- compete.playstation.com Critical
- direct.playstation.com Critical
- my.account.sony.com Critical
- my.playstation.com Critical
- profile.playstation.com Critical
- ps5.np.playstation.net Critical
- session-share.playstation.com Critical
- social.playstation.com Critical
- store.playstation.com Critical
- transact.playstation.com Critical
- wallets.api.playstation.com Critical
- web.np.playstation.com Critical
- www.playstation.com Critical
Wildcard domains 4
- *.api.playstation.com Critical
- *.playstation.com Critical No bounty
- *.playstation.net Critical
- *.sonyentertainmentnetwork.com Critical
Hardware and IoT 2
- PlayStation 4 Critical
- PlayStation 5 Critical
Android apps 1
- Android Playstation App Critical
iOS apps 1
- iOS Playstation App Critical
Rules
What the policy asks of you, and the bug types it won't reward, quoted from PlayStation (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Not use, alter, transfer, or access any data (personal or otherwise) within our environment beyond what is required to demonstrate the vulnerability
-
To immediately notify us of any inadvertent access, viewing, use, alteration, transfer, or storage of data
-
Not intentionally disrupt, and avoid and minimize the impact, degradation or harm to performance and operations of our networks, systems, information, applications, products, or services (no DDoS, form spamming, etc.)
-
Not to target or impersonate PlayStation's public presence (social media, gaming profiles, etc) as part of your testing (no defacement)
-
Otherwise comply with all applicable laws
-
Give us reasonable time to remediate vulnerabilities before talking about them publicly and notify us of your disclosure plans in advance
Not accepted
-
Brute forcing
-
Lack of rate limiting without tangible security impact (e.g, no rate limiting on a public API or login)
-
Usage of stolen credentials
-
Spam
-
Clickjacking, Login/logout CSRF
-
Fingerprinting, error message disclosure
-
Protocol level attacks (e.g BEAST/BREACH)
-
Lack of security headers (httponly flags, etc)
-
Cache poisoning without controlling content or cache poisoning denying access to non-critical files (e.g, images)
-
Content spoofing and text injection issues without being able to modify HTML/CSS
-
Best practices without security impact (e.g, RFC recommendations without security impact)
-
Denial of Service in Web / Network Assets
-
Vulnerabilities under H1's Core Ineligible Findings
-
Route53 NS hijack
-
All subdomain takeovers will be considered medium severity until further impact shown
-
Multiple instances of the same vulnerability across related assets (e.g, hosts sharing a common root cause) are treated as a single finding
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Program Overview
At PlayStation, we strive to be the best place to play, and believe that the security of our environment is fundamental to that goal. We believe that through close partnerships with the security research community we can deliver a safer place to play.
If you find a vulnerability on PlayStation or Sony asset that is not covered by the PlayStation program, please report it through Sony’s public Vulnerability Disclosure Program.
Scope
We are interested in reports on the PlayStation 5 and PlayStation 4 consoles, operating systems, and platform. Bounty-eligible PlayStation domains are listed in the scope tab.
For the PlayStation 5 and PlayStation 4 systems, accessories and operating systems, we will accept submissions on the current released or beta version of system software. PlayStation may at its discretion accept submissions on earlier versions of system software on a case by case basis.
Out-of-Scope
- PlayStation 1, PlayStation 2, PlayStation 3, PS Vita, PSP, and any other hardware not explicitly listed in our scope, including accessories and peripherals
- Any domains not explicitly listed in the scope section
- Out of scope issues submitted may be reviewed and accepted without bounty based on demonstrated impact
- Corporate IT infrastructure
- Open source software vulnerabilities which have been public for less than 7 days
- Issues targeting open source libraries or distributions may be redirected to their appropriate supporter
- Software published by third party entities, including games, applications, etc
- Vulnerabilities in third-party services where remediation is outside of PlayStation's control (e.g, SaaS tools on in-scope domains that we cannot patch)
- Social engineering attacks, including those targeting internal employees
- Physical attacks against our infrastructure, facilities and offices
- Scanner output or scanner-generated reports, including any automated or active exploit tool
- Any vulnerability obtained through the compromise of employee account
- Multiple instances of the same vulnerability across related assets (e.g, hosts sharing a common root cause) are treated as a single finding
- Vulnerabilities out of scope by default:
- Brute forcing
- Lack of rate limiting without tangible security impact (e.g, no rate limiting on a public API or login)
- Usage of stolen credentials
- Spam
- Clickjacking, Login/logout CSRF
- Fingerprinting, error message disclosure
- Protocol level attacks (e.g BEAST/BREACH)
- Lack of security headers (httponly flags, etc)
- Cache poisoning without controlling content or cache poisoning denying access to non-critical files (e.g, images)
- Content spoofing and text injection issues without being able to modify HTML/CSS
- Best practices without security impact (e.g, RFC recommendations without security impact)
- Denial of Service in Web / Network Assets
- Vulnerabilities under H1's Core Ineligible Findings
- Route53 NS hijack
- All subdomain takeovers will be considered medium severity until further impact shown
Responsible Disclosure
PlayStation firmly believes in responsible disclosure and we ask that you:
- Act in good faith, by conducting your activities under this policy, and reporting the vulnerability with us:
- Promptly
- In sufficient detail for us to determine the validity of the vulnerability
- Without coercion, dishonesty, or fraudulent intent
- Give us reasonable time to remediate vulnerabilities before talking about them publicly and notify us of your disclosure plans in advance
- If you would like to disclose a resolved vulnerability, make the request directly in your report. We look forward to disclosing issues that positively contribute to the security community
Rules of Engagement
- Not use, alter, transfer, or access any data (personal or otherwise) within our environment beyond what is required to demonstrate the vulnerability
- To immediately notify us of any inadvertent access, viewing, use, alteration, transfer, or storage of data
- To comply with our instructions for mitigating the consequences of inadvertent access, viewing, alteration, transfer of storage of data
- To facilitate clean up by detailing all data used as part of testing, your actions done as part of testing, including potentially disclosing source IP
- Not intentionally disrupt, and avoid and minimize the impact, degradation or harm to performance and operations of our networks, systems, information, applications, products, or services (no DDoS, form spamming, etc.)
- Not to target or impersonate PlayStation's public presence (social media, gaming profiles, etc) as part of your testing (no defacement)
- Otherwise comply with all applicable laws
- Violation of these requirements may result in permanent disqualification from the program, and Sony reserves the right to withhold a bounty from researchers who violate or have violated these requirements in the past
In return you can expect:
- We will respond within a timely manner
- We authorize good faith activities that conform to this policy, under the Computer Fraud and Abuse Act, and the DMCA, or similar computer access or use laws
- We will not initiate legal action or a complaint against you for accidental, good faith violations of this policy
- If there is any inconsistency between this policy and any other applicable Sony Interactive Entertainment terms, the terms of this policy will prevail
- While we cannot and do not authorize activities under this policy in the name of other parties, to the extent your activities under this policy identify vulnerabilities based on our use or implementation of the networks, systems, information, applications, products, or services of others, we:
- Authorize your good faith activities that conform to this policy, to the extent we have the authority to do so.
- Will not disclose your identity to the third party without your permission
- We will notify the third party of our authorization of your activities under this policy, as necessary.
Please note reports closed as Spam, Not Applicable, or Informative may not be approved for disclosure. Sony reserves the right to modify or terminate this program at any time.
Legal
Sony is unable to award a bounty to researchers who reside in a country that is subject to United States export sanctions or trade restrictions. Sony Interactive Entertainment employees, contractors, service providers, and their family members are not eligible for bounties.