Bug bounty program · HackerOne
Most upvoted reports4
- #2818147ValidUnsufficent input verification leads to DoS and resource consumptionSorare · Denial of Service · 2025 · Low$300108votes
- #2048725ValidCircular based introspetion Query leading to single request denial of service and cost consumption and query cost on api.sorare.com/graphqlSorare · No weakness recorded · 2024 · Medium–57votes
- #1817214ValidMystery with a leaked token and Reusability of email confirmation link leading to Account TakeoverSorare · Cryptography · 2023$30049votes
- #2067247ValidOperation CreateOrUpdateSo5LineupMutation does not restrict multiple captainsSorare · Input Validation and Logic · 2023$30023votes
Subdomains39
2 covered by the program's own scope · 0 first seen this week
39 names
| Name | Scope | First seen |
|---|---|---|
| a.sorare.com | Not in the scope | 2026-11-14 |
| admin.sorare.comadmin | Not in the scope | 2026-11-14 |
| admin-frontapp-plugin.sorare.comadmin | Not in the scope | 2026-11-14 |
| analytics.sorare.com | Not in the scope | 2026-11-14 |
| analytics-dev.sorare.comdev | Not in the scope | 2026-11-14 |
| api.sorare.comapi | In scope | 2026-11-14 |
| assets.sorare.com | Not in the scope | 2026-11-14 |
| beta.sorare.comstaging | Not in the scope | 2026-11-14 |
| beta-api.sorare.comapi, staging | Not in the scope | 2026-11-14 |
| blog.sorare.com | Not in the scope | 2026-11-14 |
| click.sorare.com | Not in the scope | 2026-11-14 |
| clicks.sorare.com | Not in the scope | 2026-11-14 |
| dashboard.sorare.comadmin | Not in the scope | 2026-11-14 |
| eu-west-3.sorare.com | Not in the scope | 2026-11-14 |
| frontend-assets.sorare.com | Not in the scope | 2026-11-14 |
| get.sorare.com | Not in the scope | 2026-11-14 |
| go.sorare.com | Not in the scope | 2026-11-14 |
| help.sorare.com | Not in the scope | 2026-11-14 |
| img.sorare.com | Not in the scope | 2026-11-14 |
| infra.sorare.com | Not in the scope | 2026-11-14 |
| join.sorare.com | Not in the scope | 2026-11-14 |
| mcp.sorare.com | Not in the scope | 2026-11-14 |
| mlbguide.sorare.com | Not in the scope | 2026-11-14 |
| nbaguide.sorare.com | Not in the scope | 2026-11-14 |
| bz245.play.sorare.com | Not in the scope | 2026-11-14 |
| proxy.sorare.com | Not in the scope | 2026-11-14 |
| rancher.sorare.comtools | Not in the scope | 2026-11-14 |
| sab.sorare.com | Not in the scope | 2026-11-14 |
| staging.sorare.comstaging | Not in the scope | 2026-11-14 |
| a.staging.sorare.comstaging | Not in the scope | 2026-11-14 |
| admin.staging.sorare.comadmin, staging | Not in the scope | 2026-11-14 |
| api.staging.sorare.comapi, staging | Not in the scope | 2026-11-14 |
| status.sorare.commonitoring | Not in the scope | 2026-11-14 |
| support.sorare.com | Not in the scope | 2026-11-14 |
| us-east-2.sorare.com | Not in the scope | 2026-11-14 |
| verdaccio.sorare.com | Not in the scope | 2026-11-14 |
| wallet.sorare.com | Not in the scope | 2026-11-14 |
| ws.sorare.com | In scope | 2026-11-14 |
| www.sorare.com | Not in the scope | 2026-11-14 |
Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. See the subdomains on the Atlas or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.