Does The Walt Disney Company have a bug bounty program?

The Walt Disney Company runs a public vulnerability disclosure program (VDP) on HackerOne. It accepts good-faith security reports but does not offer cash rewards. It lists 17 in-scope assets.

bounty.index

Featured on

Ship notes · new platforms · outagesFollow @TheV_Stack for bounty.index updates

programs/HackerOne/disney

The Walt Disney Company

HackerOne·updated 3h ago

vdpmanagedopen

Discord → RSS

payout: no bounty
scope: 17 in · 14 out
safe harbor: unknown
response: no reports

open program

hunt score

vdpfresh

formula →

payout

0/55

bounty

0/20

freshness

25/25

how we sort the index, not an estimate of what you’ll earn

Attack surface

17 in-scope

12urls
5other

Scope

In scope

017

urls12

+abcspotdepot.com· critical
+disneyauditions.com· critical
+disneyland.disney.go.com· critical
+disneyplus.link· critical
+disneytravelagents.com· critical
+disneyvacationclub.disney.go.com· critical
+dvc-lightcycle-api.wdprapps.disney.com· critical
+espn.com· critical
+shanghaidisneyresort.com.cn· critical
+www.magicalphotos.cn· critical
▸▾show 2 morehide 2 more
- +www.shanghaidisneyresort.com· critical
- +www.shanghaidisneyresort.com.cn· critical

other05

+Disney Corporate· critical
+MyID Pre-auth Bypass· critical
+Valid Disney Retiree Credential· medium
+com.espn.score_center· critical
+id317469184· critical

Out of scope

014

−affiliate.disney.espn.courl
−dolimg.comurl
−dwss-ptp.disney.comurl
−espnbet.comurl
−hotstar.comurl
−kingdomhearts.comurl
−magicalfloralandgifts.comurl
−magicpass.com.mxurl
−star.comurl
−tokyodisneyresort.jpurl
▸▾show 4 morehide 4 more
- −unclaimedproperty.disney.comurl
- −www.disneyexibidor.com.brurl
- −www.enchantedfinejewelry.comurl
- −www.waltdisney.orgurl

Change history

1 event

2026-08-06
first indexed
92d ago · 17 in-scope assets

// only one snapshot on record, changes appear from the next ingest onward

Community reports

0 reports

No reports yet. Be the first to share your triage timing for The Walt Disney Company.

// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.

Your notes

▸ raw source payload

{
  "id": 0,
  "url": "https://hackerone.com/disney",
  "name": "The Walt Disney Company",
  "handle": "disney",
  "targets": {
    "in_scope": [
      {
        "asset_type": "OTHER",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "Disney Corporate",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "Find a MyID app pre-loading Javascript that give you access to an API? Report it here. Follow the rules against automation. Don't wire up some big scanner that gets you popper for making network noise. This is an opportunity for safe, controlled analysis of pre-loaded content. Have fun. Looking forward to your greatness being on-display. Thank you! Always include your request-header for identification. This covers all in-scope VDP assets.",
        "max_severity": "critical",
        "asset_identifier": "MyID Pre-auth Bypass",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": null,
        "max_severity": "medium",
        "asset_identifier": "Valid Disney Retiree Credential",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Created to clarify this is in scope.",
        "max_severity": "critical",
        "asset_identifier": "abcspotdepot.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "GOOGLE_PLAY_APP_ID",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "com.espn.score_center",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "disneyauditions.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "disneyland.disney.go.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "disneyplus.link",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "disneytravelagents.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "disneyvacationclub.disney.go.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Do not test on:\n/api/v1/*",
        "max_severity": "critical",
        "asset_identifier": "dvc-lightcycle-api.wdprapps.disney.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "espn.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER_IPA",
        "instruction": "This is the ESPN iOS App",
        "max_severity": "critical",
        "asset_identifier": "id317469184",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "shanghaidisneyresort.com.cn",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "NO TESTING from 27th - 3rd of every month for maintenance window.",
        "max_severity": "critical",
        "asset_identifier": "www.magicalphotos.cn",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Thanks 'encodedguy'\n\n**Maintenance Notice**\nNO TESTING from 27th - 3rd of every month for maintenance window.",
        "max_severity": "critical",
        "asset_identifier": "www.shanghaidisneyresort.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "NO TESTING from 27th - 3rd of every month for maintenance window.",
        "max_severity": "critical",
        "asset_identifier": "www.shanghaidisneyresort.com.cn",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      }
    ],
    "out_of_scope": [
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "affiliate.disney.espn.co",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "none",
        "asset_identifier": "dolimg.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "dwss-ptp.disney.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "espnbet.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "hotstar.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "kingdomhearts.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "magicalfloralandgifts.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "magicpass.com.mx",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "star.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "This licensing partnership site is OUT of scope of the VDP.",
        "max_severity": "none",
        "asset_identifier": "tokyodisneyresort.jp",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "unclaimedproperty.disney.com",
        "eligible_for_bounty": false,
        "integrity_requirement": "none",
        "eligible_for_submission": false,
        "availability_requirement": "none",
        "confidentiality_requirement": "none"
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "www.disneyexibidor.com.br",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "www.enchantedfinejewelry.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "www.waltdisney.org",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      }
    ]
  },
  "website": "https://thewaltdisneycompany.com/",
  "offers_swag": false,
  "managed_program": true,
  "offers_bounties": false,
  "submission_state": "open",
  "allows_bounty_splitting": false,
  "average_time_to_bounty_awarded": null,
  "response_efficiency_percentage": 71,
  "average_time_to_report_resolved": 1765,
  "average_time_to_first_program_response": 1
}