Skip to content
Connect AISign inSign up free

Bug bounty program

AV

AWS VDP

Open on HackerOneAtlas
Platform
HackerOne
Bounties
None
Assets in scope
555
Disclosed reports
61
Subdomains
3,037

Most upvoted reports61

All reports
Most upvoted reports of AWS VDP
ReportWeaknessDisclosedBountyVotes
OS Command Injection in `aws-cdk-lib` NodejsFunction via Unsanitized `OsCommand` Helper (Supply Chain RCE)Analysed#3637898Command and Code Injection2026-07-06–111
XSS on Amazon Aquisition: elementalAnalysed#3205667Cross-site Scripting2025-07-22–83
Non-Production API Endpoints for the Forecast Service Fail to Log to CloudTrail Resulting in Silent Permission EnumerationAnalysed#3022516Other weaknesses2025-03-24–75
Unlimited Reuse of Coupon Code Allows Free Shipping on All Orders on ██████████Analysed#3426839Input Validation and Logic2026-02-09–69
Non-Production API Endpoints for the Amazon S3 Tables Service Fails to Log to CloudTrail Resulting in Silent Permission EnumerationAnalysed#3780277Other weaknesses2026-07-02–69
A potential risk in the aws-lambda-ecs-run-task which can be used to privilege escalation.Analysed#2894222Access Control2024-12-27–68
External service interaction (HTTP)Analysed#2731133Server-Side Request Forgery2024-10-04–62
AWS | Self Registration Internal LibreChat : Access to internal/proprietary LLMsAnalysed#3287396Authentication2025-08-25–61
QuickSight Authorization Bypass: Chat Agents Accessible Despite Custom Permissions DenialAnalysed#3577145No weakness recorded2026-05-12–59
(Part 2) Non-Production API Endpoints for the Datazone Service Fail to Log to CloudTrail Resulting in Silent Permission EnumerationAnalysed#3014785Other weaknesses2025-04-08–56

Subdomains3,037

Root
Scope
Name suggests:Test and QA
First seen
Text fileClear filters16 names
Subdomains of AWS VDP
NameScopeFirst seen
iq-test.console.aws.amazon.comadmin, testIn scope2026-11-14
iq-test.aws.amazon.comtestIn scope2026-11-14
docs-jwcc-zonbook-test.jwcc-integ.aws.amazon.comtestIn scope2026-11-14
aws-demo-alva.signin.aws.amazon.comauth, testIn scope2026-11-14
fredhutch-cortex-data-platform-sandbox.signin.aws.amazon.comauth, testIn scope2026-11-14
hmh-hmhco-sandbox.signin.aws.amazon.comauth, testIn scope2026-11-14
test.kovid.signin.aws.amazon.comauth, testIn scope2026-11-14
rt3-sandbox.signin.aws.amazon.comauth, testIn scope2026-11-14
test.signin.aws.amazon.comauth, testIn scope2026-11-14
test-kovid.signin.aws.amazon.comauth, testIn scope2026-11-14
tts-sandbox.signin.aws.amazon.comauth, testIn scope2026-11-14
v1.soap-demo.aws.amazon.comapi, testIn scope2026-11-14
test.aws.amazon.comtestIn scope2026-11-14
test-ipv6-vpce-amazon.aws.amazon.comtestIn scope2026-11-14
vs-test.aws.amazon.comtestIn scope2026-11-14
webauthn-signin-testing.aws.amazon.comauth, testIn scope2026-11-14

3,036 names are covered by the program's own scope; 1 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated