Bug bounty program
CH
Chainlink
Most upvoted reports2
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| No Valid SPF Records.#629087 | Authentication | 2019-07-18 | – | 52 |
| Testnet address being sent in cleartext as http://rinkeby.chain.link/ is missing SSL certificate#576288 | Cryptography | 2019-07-17 | – | 19 |
Subdomains420
| Name | Scope | First seen |
|---|---|---|
| xpn-test.chain.linktest | Not in the scope | 2026-11-14 |
| login-sandbox.cre.chain.linkauth, test | Not in the scope | 2026-11-14 |
| test.tokenmanager.chain.linktest | Not in the scope | 2026-11-14 |
| zone-c-test-gateway.chain.linktest | Not in the scope | 2026-11-14 |
| mt1.sandbox.enterprise.chain.linktest | Not in the scope | 2026-11-14 |
| st1.sandbox.enterprise.chain.linktest | Not in the scope | 2026-11-14 |
| st4.sandbox.enterprise.chain.linktest | Not in the scope | 2026-11-14 |
| st6.sandbox.enterprise.chain.linktest | Not in the scope | 2026-11-14 |
| wif.sandbox.enterprise.chain.linktest | Not in the scope | 2026-11-14 |
| bcm1.sandbox.enterprise.chain.linktest | Not in the scope | 2026-11-14 |
| bcm3.sandbox.enterprise.chain.linktest | Not in the scope | 2026-11-14 |
| bonk.sandbox.enterprise.chain.linktest | Not in the scope | 2026-11-14 |
| demo.sandbox.enterprise.chain.linktest | Not in the scope | 2026-11-14 |
| fwog.sandbox.enterprise.chain.linktest | Not in the scope | 2026-11-14 |
| pepe.sandbox.enterprise.chain.linktest | Not in the scope | 2026-11-14 |
| shib.sandbox.enterprise.chain.linktest | Not in the scope | 2026-11-14 |
| neiro.sandbox.enterprise.chain.linktest | Not in the scope | 2026-11-14 |
| test.expert.tokenmanager.chain.linktest | Not in the scope | 2026-11-14 |
| kabosu.sandbox.enterprise.chain.linktest | Not in the scope | 2026-11-14 |
| popcat.sandbox.enterprise.chain.linktest | Not in the scope | 2026-11-14 |
| ipfs-test.smartcontract.comtest | In scope | 2026-11-14 |
| uat.complink.smartcontract.comtest | In scope | 2026-11-14 |
| uat.complink-ext.smartcontract.comtest | In scope | 2026-11-14 |
192 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.