Nintendo
Nintendo · HackerOne · added Dec 6, 2016
Nintendo’s goal is to provide a secure environment for our customers so that they can enjoy our games and services. In order to achieve this goal, Nintendo is i…
Metrics
Beginner fit
54/100
Estimated: this program accepts low-severity findings worth reporting.
Activity metrics for this program aren't exposed by the platform API, so the scores above are conservative estimates. Always verify on the program page before submitting.
Engage
Open on HackerOneAlways read the full policy on the platform before submitting. Scope below is a summary only.
In-scope assets
- Nintendo Switch System
- Nintendo Switch applications for which Nintendo is the publisher worldwide
- Nintendo Switch 2 applications for which Nintendo is the publisher worldwide
- Nintendo Switch 2 Security controller known as PSC or Platform Security Controller (any component) / Security controller known as TSEC (bootROM only)
- Nintendo Switch 2 Kernel / ARM® TrustZone®
- Nintendo Switch 2 System Processes allowing piracy
- Nintendo Switch 2 System Processes
Fetched live from the HackerOne API.
Wanted categories
Who should hunt here
Beginners
A stretch- 1 asset in scope gives you room to explore without fighting a crowd for the same endpoints.
- Fast feedback — triage lands in ~3 days, so you learn what this team pays for quickly.
Intermediate
Workable- APIs are in scope — where medium hunters get paid: broken object-level authorization, mass assignment, and rate-limit gaps.
Pros
Efficient filler- Modest for a pro — but low crowding makes it a reliable filler between bigger programs.
Think twice if
- Heavily crowded — duplicates arrive within hours; only novel vectors or automation win here.
- No bounty range is published by the HackerOne API — confirm actual payouts on the program page before investing time.
- HackerOne doesn't publish report volume — the competition and fit scores here are conservative estimates, not measurements.
- Narrow scope (1 asset) — limited room if you're looking for breadth.
Where these numbers come from
Live from HackerOne
- Program status, policy text & start date — live HackerOne API
- Full in-scope asset list — fetched live from the structured-scopes endpoint
Modeled estimates
- Bounty range — the HackerOne API doesn't publish it (shown as —)
- Report volume & hunter count — not exposed; competition is scored from neutral defaults
- Triage speed — modeled from the program's triage-activity flag
- Beginner fit — computed from the signals above (methodology on this page)
Recon launchpad
One-click starting points per asset — certificate history, archived pages, leaked code, and exposed hosts. Open results in their own tabs.
hackerone.com