Underdog Fantasy Vulnerability Disclosure

generated: '2026-08-02'
method: searched
probe: true
source: https://underdogfantasy.com/.well-known/security.txt
policy: []
contact:
- mailto:security@underdogsports.com
encryption:
- https://underdogsports.com/.well-known/udsecurity.asc
canonical:
- https://underdogsports.com/.well-known/security.txt
expires: '2027-04-13T00:00:00Z'
preferred_languages:
- en
hiring: https://underdogsports.com/careers
bug_bounty:
  program: null
  note: No public bug bounty program was verified. hackerone.com/underdog and bugcrowd.com/underdog
    each return HTTP 200 but serve only the platform's generic single-page-app shell
    with no Underdog program content, so neither was recorded as a hit.
files:
- path: well-known/underdog-fantasy-security.txt
  description: RFC 9116 security.txt saved verbatim
- path: well-known/underdog-fantasy-security-key.asc
  description: PGP public key referenced by the security.txt Encryption field, saved
    verbatim
notes:
- The security.txt is served from underdogfantasy.com (HTTP 200, text/plain) and names
  underdogsports.com as its Canonical location, but that canonical URL currently returns
  HTTP 404 — an RFC 9116 Canonical mismatch worth reporting to the provider.
- The Encryption field points at https://underdogsports.com/.well-known/udsecurity.asc
  (HTTP 404); the same key is served at https://underdogfantasy.com/.well-known/udsecurity.asc
  (HTTP 200).
- No /security, /responsible-disclosure or /vulnerability-disclosure page exists on
  either underdogfantasy.com or underdogsports.com (all HTTP 404).
evidence:
- source: well-known/underdog-fantasy-security.txt
  kind: security.txt
- source: well-known/underdog-fantasy-security-key.asc
  kind: pgp-key
x-evidence:
- url: https://underdogfantasy.com/.well-known/security.txt
  http_status: 200
  content_type: text/plain; charset=utf-8
  fetched: '2026-08-02'
- url: https://underdogfantasy.com/.well-known/udsecurity.asc
  http_status: 200
  fetched: '2026-08-02'
- url: https://underdogsports.com/.well-known/security.txt
  http_status: 404
  fetched: '2026-08-02'
- url: https://underdogsports.com/.well-known/udsecurity.asc
  http_status: 404
  fetched: '2026-08-02'