SU
HackerOneOffers Rewards
Superbet
Superbet appears to run a bug bounty or vulnerability disclosure program on HackerOne. It also offers rewards for valid security reports.
Created: February 15, 2026
Last Updated: October 5, 2026
In Scope (28)
*.happening.dev
*.luckydays.ca ( we have a lot of 3rd party's such as cpanels/etc which will are OOS so if you are in doubt, contact [email protected]. )
*.luckydays.com ( we have a lot of 3rd party's such as cpanels/etc which will are OOS so if you are in doubt, contact [email protected]. )
*.napoleoncasino.be ( You need a real/fake Belgium ID to register an account on the main casino/sport app.
You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution )
*.napoleondice.be ( You need a real/fake Belgium ID to register an account on the main casino/sport app.
You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution )
*.napoleongames.be ( You need a real/fake Belgium ID to register an account on the main casino/sport app.
You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution )
*.napoleonsports.be ( You need a real/fake Belgium ID to register an account on the main casino/sport app.
You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution )
*.spinaway.com ( we have a lot of 3rd party's such as cpanels/etc which will are OOS so if you are in doubt, contact [email protected]. )
*.super.xyz
*.superbet.com
*.superbet.gr ( Websites only available from Greece use VPN
Test Accounts: 26hackeronegreece01 - qPW2R%jnniYn4hrP 26hackeronegreece02 - jjqAW@l34KsXbXJJ 26hackeronegreece03 - 8tjK%tv&Pp%pUbcM 26hackeronegreece04 - 2aZxrZ@r8enzkp%f 26hackeronegreece05 - gYaUJdkDgc3@5x34 )
*.superbet.pl ( Website available only from Poland use VPN Test Accounts: 26hackeronepoland02 - ZIzUxh@D1FWrb@yF 26hackeronepoland03 - 6J@K%IU9fVbMhCe9 26hackeronepoland04 - a%TlmhYhTxaMA%@8 26hackeronepoland05 - hCR63P@vPWGj&Rws
26hackeronepoland06 - rI%nUj6E%cU5Lpkd )
*.superbet.ro ( For our main application superbet.ro You can use a Romanian fake CNP generator in order to create an account, such as - https://isj.educv.ro/cnp/ in order to create an account. Make sure you are using a Romanian VPN as the portal works only for Romanian IP’s.
Or use a test account from this list:
26hackeroneromania02 - IrKFiZ5fm#h2r0a6
26hackeroneromania03 - RF0nMx%fQiSUtZu@
26hackeroneromania04 - w#!G4%&AppmVs9s1
26hackeroneromania05 - NKpFn06Y#Wl1eojv
26hackeroneromania06 - f5M73r4XLRdQU@Hq
● Please add the following User-Agent header when you are using any automated tools or scripts - User-agent: hackerone -. Requests that will not contain this cookie header might get blocked by our tools/SOC team. )
*.superbet.rs ( This is our new betting platform, available only in serbia. We only allow connection from Serbian Ip's, so please use a VPN.
Test Accounts:
26hackeroneserbia06 - YAJ6chCI9ra3fX%s
26hackeroneserbia07 - 3hoPBI2sQRuIxDJ#
26hackeroneserbia08 - Wqs!C7b8LLURfgbH
26hackeroneserbia09 - @p0fNOlvVJLwZobb
26hackeroneserbia10 - a1LWLzyAIns@HWY5 )
WGP Slot Games ( All games from WGP provider are in scope for testing. You can find them by filtering for WGP provider on Napoleon platform. Make sure you use VPN for BE.
https://napoleoncasino.be/en-be/games/search?query=wgp )
https://napoleoncasino.be ( Website available only from Belgium
You need a real/fake Belgium ID to register an account on the main casino/sport app. You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution )
https://napoleoncasino.be/en-be/game/hogamba-crash?demo=false ( slot game available on be/ro platforms and on BR in the future. )
https://napoleoncasino.be/nl-be/game/plinko-napoleon?demo=false
https://napoleondice.be ( Website available only from Belgium.
You need a real/fake Belgium ID to register an account on the main casino/sport app. You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution )
https://napoleongames.be ( Website available only from Belgium
You need a real/fake Belgium ID to register an account on the main casino/sport app. You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution )
https://napoleonsports.be ( Website available only from Belgium. You need a real/fake Belgium ID to register an account on the main casino/sport app. You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution )
https://super.xyz ( low impact asset (3rd party managed service) with no sensitive data/functionality on it. )
https://superbet.pl ( Website available only from Poland use VPN
Test Accounts:
26hackeronepoland02 - ZIzUxh@D1FWrb@yF
26hackeronepoland03 - 6J@K%IU9fVbMhCe9
26hackeronepoland04 - a%TlmhYhTxaMA%@8
26hackeronepoland05 - hCR63P@vPWGj&Rws
26hackeronepoland06 - rI%nUj6E%cU5Lpkd )
https://superbet.ro ( For our main application superbet.ro You can use a Romanian fake CNP generator in order to create an account, such as - https://isj.educv.ro/cnp/ in order to create an account. Make sure you are using a Romanian VPN as the portal works only for Romanian IP’s.
Or use a test account from this list:
26hackeroneromania02 - IrKFiZ5fm#h2r0a6
26hackeroneromania03 - RF0nMx%fQiSUtZu@
26hackeroneromania04 - w#!G4%&AppmVs9s1
26hackeroneromania05 - NKpFn06Y#Wl1eojv
26hackeroneromania06 - f5M73r4XLRdQU@Hq
● Please add the following User-Agent header when you are using any automated tools or scripts - User-agent: hackerone -. Requests that will not contain this cookie header might get blocked by our tools/SOC team. )
https://superbet.rs ( Website available only from Serbia use VPN
Test Account:
26hackeroneserbia06 - YAJ6chCI9ra3fX%s
26hackeroneserbia07 - 3hoPBI2sQRuIxDJ#
26hackeroneserbia08 - Wqs!C7b8LLURfgbH
26hackeroneserbia09 - @p0fNOlvVJLwZobb
26hackeroneserbia10 - a1LWLzyAIns@HWY5 )
ro.superbet.games ( Make sure you change your google play country to Romania so you can access the app.
https://play.google.com/store/apps/details?id=ro.superbet.games&hl=ro&gl=RO )
ro.superbet.sport ( Make sure you set the location to your google play account to Romania so you can access the app
https://play.google.com/store/apps/details?id=ro.superbet.sport&hl=ro&gl=RO )
superbet.bet.br ( Website available only for Brazil use VPN.
Test Accounts:
26hackeronebrazil02 - NyX#xTsIz8@8mku0
26hackeronebrazil03 - LQg@9wyRk#7Xj!wX
26hackeronebrazil04 - 1p99kdS1PeD&PZaf
26hackeronebrazil05 - 4lz@ZvKqIp5z!vl7
26hackeronebrazil06 - r0G#ViDGd!epgr4& )
Out of Scope (16)
*.epic.superbet.ro
affiliate.napoleongames.be ( 3rd party )
affiliates.superbet.com
affiliates.superbet.rs
http://abc.superbet.rs ( 3rd party )
http://surveys.superbet.com
https://afiliados.superbet.com ( 3rd party, out of scope )
https://legacy-web.superbet.ro/session/login ( All our LOGIN services are out of scope for the moment.
Any bruteforce attempt on our login services will be considered misbehavior and you will be banned from the program. We won't reward any credentials identified using bruteforce attacks.
Thank you! )
https://retail.prod.incubator.superbet.ro/ssbt-api/ ( out of scope )
lp.superbet.bet.br
lp.superbet.com
lp.superbet.pl
lp.superbet.ro
lp.superbet.rs
test-gw.epic.superbet.ro
test.epic.superbet.ro