Dazn Vulnerability Disclosure

generated: '2026-08-12'
method: searched
probe: true
source: https://www.dazn.com/.well-known/security.txt
policy:
  - https://www.dazn.com/en-GB/help/articles/responsible-disclosure
  - https://help.dazn.com/hc/en-us/articles/16471531900317-Global-Responsible-Disclosure-for-Security-Vulnerabilities-Policy
contact:
  - mailto:security@dazn.com
preferred_languages: [en]
canonical: https://www.dazn.com/.well-known/security.txt
expires: '2026-12-31T23:00:00.000Z'
hiring: https://careers.dazn.com/technology
bug_bounty:
  program: none
  note: >-
    No HackerOne, Bugcrowd or Intigriti program found for DAZN. The policy is a coordinated/
    responsible-disclosure commitment with a safe-harbour statement (DAZN states it will not pursue
    civil action or prosecution against researchers reporting in good faith under the policy), not a
    paid bounty.
policy_url_caveat: >-
  The Policy URL DAZN publishes in security.txt (www.dazn.com/en-GB/help/articles/responsible-
  disclosure) is served by a client-rendered SPA — the static response is the site's generic
  95,145-byte shell, which a non-JS client reads as a 404. The same policy is reachable server-side
  on DAZN's Zendesk help centre, which is the URL wired as the `Security` pointer. This is a real
  discoverability defect in DAZN's security.txt worth reporting back to them.
evidence:
  - {source: 'https://www.dazn.com/.well-known/security.txt', kind: security.txt (live probe), status: 200, content_type: text/plain}
  - {source: 'https://www.dazn.com/en-GB/help/articles/responsible-disclosure', kind: policy page, status: 200, note: 'soft-200 SPA shell; content renders only with JavaScript'}
  - {source: 'https://help.dazn.com/hc/en-us/articles/16471531900317-Global-Responsible-Disclosure-for-Security-Vulnerabilities-Policy', kind: policy page, status: 403, note: 'Zendesk bot protection blocks unauthenticated automated fetch; page is publicly indexed and reachable in a browser'}