Bug bounty program

AWS VDP

Platform: HackerOne
Bounties: None
Assets in scope: 555
Disclosed reports: 61
Subdomains: 3,037

Most upvoted reports61

Most upvoted reports of AWS VDP
Report	Weakness	Disclosed	Bounty	Votes
OS Command Injection in `aws-cdk-lib` NodejsFunction via Unsanitized `OsCommand` Helper (Supply Chain RCE)Analysed#3637898	Command and Code Injection	2026-07-06	–	111
XSS on Amazon Aquisition: elementalAnalysed#3205667	Cross-site Scripting	2025-07-22	–	83
Non-Production API Endpoints for the Forecast Service Fail to Log to CloudTrail Resulting in Silent Permission EnumerationAnalysed#3022516	Other weaknesses	2025-03-24	–	75
Unlimited Reuse of Coupon Code Allows Free Shipping on All Orders on ██████████Analysed#3426839	Input Validation and Logic	2026-02-09	–	69
Non-Production API Endpoints for the Amazon S3 Tables Service Fails to Log to CloudTrail Resulting in Silent Permission EnumerationAnalysed#3780277	Other weaknesses	2026-07-02	–	69
A potential risk in the aws-lambda-ecs-run-task which can be used to privilege escalation.Analysed#2894222	Access Control	2024-12-27	–	68
External service interaction (HTTP)Analysed#2731133	Server-Side Request Forgery	2024-10-04	–	62
AWS \| Self Registration Internal LibreChat : Access to internal/proprietary LLMsAnalysed#3287396	Authentication	2025-08-25	–	61
QuickSight Authorization Bypass: Chat Agents Accessible Despite Custom Permissions DenialAnalysed#3577145	No weakness recorded	2026-05-12	–	59
(Part 2) Non-Production API Endpoints for the Datazone Service Fail to Log to CloudTrail Resulting in Silent Permission EnumerationAnalysed#3014785	Other weaknesses	2025-04-08	–	56

Weaknesses of its reports

In scope

Other assets536 assets*.agscollab.com · *.agslauncher.com · *.amazongames.com · *.aws.dev · *.cloudendure.com · *.gaming.amazon.com · *.lambda-url.*.on.aws · *.newworld.com
Source code10 assetshttps://github.com/amazonlinux/amazon-linux-2023 · https://github.com/aws-actions/* · https://github.com/aws/amazon-ecs-agent · https://github.com/aws/amazon-ecs-cli · https://github.com/aws/amazon-vpc-cni-k8s · https://github.com/aws/aws-cdk · https://github.com/aws/aws-cli · https://github.com/aws/aws-sdk
Wildcard domains4 assets*.lostark.games.aws.dev · https://github.com/awslabs/* · https://github.com/deepjavalibrary/* · https://github.com/strands-agents/*
Web applications3 assetsforums.newworld.com · https://github.com/aws-samples · www.awseducate.com
Mobile apps1 asset1023499075
APIs1 assetAll API's called by the AWS CLI

Subdomains3,037

Root:amazon.com

amazon.com3,037

Scope

Name suggests:Monitoring

First seen

Text fileClear filters3 names

Subdomains of AWS VDP
Name	Scope	First seen
monitoring-account-prashantkc.signin.aws.amazon.comauth, monitoring	In scope	2026-11-14
status.aws.amazon.commonitoring	In scope	2026-11-14
dev.status.aws.amazon.comdev, monitoring	In scope	2026-11-14

3,036 names are covered by the program's own scope; 1 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.