Skip to content
Sign in

Bug bounty program

DU

DuckDuckGo

Open on HackerOneAtlas
Platform
HackerOne
Bounties
None
Assets in scope
4
Disclosed reports
16
Subdomains
765

Most upvoted reports16

All reports
Most upvoted reports of DuckDuckGo
ReportWeaknessDisclosedBountyVotes
DOM XSS on duckduckgo.com searchAnalysed#868934No weakness recorded2020-06-14–326
XXE on https://duckduckgo.com#483774Injection and Smuggling2019-01-31–218
SSRF on duckduckgo.com/iu/#398641Server-Side Request Forgery2018-09-09–165
Partial bypass of #483774 with Blind XXE on https://duckduckgo.com#486732Injection and Smuggling2019-02-25–159
Reflected/Stored XSS on duckduckgo.com#1110229Cross-site Scripting2021-04-10–135
SSRF with bypass leads to client side hosting / vulnerabilities ( XSS and others )#3522157Server-Side Request Forgery2026-09-17$50077
DOM XSS on duckduckgo.com search#876148Cross-site Scripting2020-06-26–74
XSS on Videos IA#910427Cross-site Scripting2020-07-31–67
RCE + PAT Exfiltration via pull_request_target in privacy-configuration/auto-respond-pr.yml — Direct Supply Chain to All DDG Browsers#3619288No weakness recorded2026-06-11–66
RCE + Supply Chain Attack via pull_request_target in content-scope-scripts/semver-label.yml — Affects All DuckDuckGo Browsers#3619287No weakness recorded2026-06-11–41

Subdomains765

Root
Scope
Name suggests
First seen
Text file765 names
Subdomains of DuckDuckGo
NameScopeFirst seen
20211901170251-external-content.duckduckgo.comIn scope2026-11-14
45084.duckduckgo.comIn scope2026-11-14
6665109858176.duckduckgo.comIn scope2026-11-14
7eed400.duckduckgo.comIn scope2026-11-14
937a1.duckduckgo.comIn scope2026-11-14
96b4122a69.duckduckgo.comIn scope2026-11-14
9e42ac936b0443277.duckduckgo.comIn scope2026-11-14
a7f982.duckduckgo.comIn scope2026-11-14
aaron.duckduckgo.comIn scope2026-11-14
abeyang.duckduckgo.comIn scope2026-11-14
abeyang-new.duckduckgo.comIn scope2026-11-14
about.duckduckgo.comIn scope2026-11-14
abrown.duckduckgo.comIn scope2026-11-14
ac.duckduckgo.comIn scope2026-11-14
agimenez.duckduckgo.comIn scope2026-11-14
amartemyanov.duckduckgo.comIn scope2026-11-14
amiseed-dev.duckduckgo.comdevIn scope2026-11-14
amiseed-ops.duckduckgo.comIn scope2026-11-14
andrey.duckduckgo.comIn scope2026-11-14
ankit.duckduckgo.comIn scope2026-11-14
api.duckduckgo.comapiIn scope2026-11-14
search.api.duckduckgo.comapiIn scope2026-11-14
asana.duckduckgo.comIn scope2026-11-14
ase-daniel1.duckduckgo.comIn scope2026-11-14
ase-ip-2.duckduckgo.comIn scope2026-11-14
ase-rjain1.duckduckgo.comIn scope2026-11-14
ashish.duckduckgo.comIn scope2026-11-14
audio.duckduckgo.comIn scope2026-11-14
aue-aboron1.duckduckgo.comIn scope2026-11-14
aue-bgonzalez1.duckduckgo.comIn scope2026-11-14
aue-dmalone1.duckduckgo.comIn scope2026-11-14
aue-fcuevas1.duckduckgo.comIn scope2026-11-14
aue-jbrendel1.duckduckgo.comIn scope2026-11-14
aue-jhamilton1.duckduckgo.comIn scope2026-11-14
aue-kshannon1.duckduckgo.comIn scope2026-11-14
aue-mmeyer1.duckduckgo.comIn scope2026-11-14
aue-randerson1.duckduckgo.comIn scope2026-11-14
aue-srazzaque1.duckduckgo.comIn scope2026-11-14
auth.duckduckgo.comauthIn scope2026-11-14
autodiscover.duckduckgo.commailIn scope2026-11-14
avianasanchez.duckduckgo.comIn scope2026-11-14
avinash.duckduckgo.comIn scope2026-11-14
b2.duckduckgo.comIn scope2026-11-14
b2-new.duckduckgo.comIn scope2026-11-14
bangreview.duckduckgo.comIn scope2026-11-14
bartek.duckduckgo.comIn scope2026-11-14
bastion.duckduckgo.comIn scope2026-11-14
beta.duckduckgo.comstagingIn scope2026-11-14
beta-new.duckduckgo.comstagingIn scope2026-11-14
bhall.duckduckgo.comIn scope2026-11-14
blah.duckduckgo.comIn scope2026-11-14
blake.duckduckgo.comIn scope2026-11-14
blink.duckduckgo.comIn scope2026-11-14
blog.duckduckgo.comIn scope2026-11-14
brad.duckduckgo.comIn scope2026-11-14
brad-slayter.duckduckgo.comIn scope2026-11-14
brian.duckduckgo.comIn scope2026-11-14
brian-new.duckduckgo.comIn scope2026-11-14
brian12.duckduckgo.comIn scope2026-11-14
brindy.duckduckgo.comIn scope2026-11-14
brs-jpereira1.duckduckgo.comIn scope2026-11-14
brs-marcos1.duckduckgo.comIn scope2026-11-14
bslayter.duckduckgo.comIn scope2026-11-14
bttf.duckduckgo.comIn scope2026-11-14
c23334ba.duckduckgo.comIn scope2026-11-14
caine.duckduckgo.comIn scope2026-11-14
cali-proxy3.duckduckgo.comIn scope2026-11-14
cali-xl1.duckduckgo.comIn scope2026-11-14
cali-xl3.duckduckgo.comIn scope2026-11-14
cali-zach.duckduckgo.comIn scope2026-11-14
cbelmber.duckduckgo.comIn scope2026-11-14
cbelmer.duckduckgo.comIn scope2026-11-14
cbelmer-ops.duckduckgo.comIn scope2026-11-14
cbolin.duckduckgo.comIn scope2026-11-14
cc27dec2.duckduckgo.comIn scope2026-11-14
cclarke.duckduckgo.comIn scope2026-11-14
charmston.duckduckgo.comIn scope2026-11-14
chat.duckduckgo.comIn scope2026-11-14
chat-prod-noble.duckduckgo.comIn scope2026-11-14
chat-staging.duckduckgo.comstagingIn scope2026-11-14
chat-staging-noble.duckduckgo.comstagingIn scope2026-11-14
chatgpt.duckduckgo.comIn scope2026-11-14
chef.duckduckgo.comIn scope2026-11-14
chrome.duckduckgo.comIn scope2026-11-14
chuston.duckduckgo.comIn scope2026-11-14
collect.duckduckgo.comIn scope2026-11-14
content.duckduckgo.comIn scope2026-11-14
craig.duckduckgo.comIn scope2026-11-14
cristian.duckduckgo.comIn scope2026-11-14
d98625b3-120a-402a-be2b-92775cc9989c-dev.duckduckgo.comdevIn scope2026-11-14
daffy.duckduckgo.comIn scope2026-11-14
daniel.duckduckgo.comIn scope2026-11-14
daniele.duckduckgo.comIn scope2026-11-14
dantest.duckduckgo.comIn scope2026-11-14
dave.duckduckgo.comIn scope2026-11-14
david.duckduckgo.comIn scope2026-11-14
davidg.duckduckgo.comIn scope2026-11-14
db3e67.duckduckgo.comIn scope2026-11-14
dbp.duckduckgo.comIn scope2026-11-14
dbp-staging.duckduckgo.comstagingIn scope2026-11-14

765 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in