Bug bounty program
DU
DuckDuckGo
- Platform
- HackerOne
- Bounties
- None
- Assets in scope
- 4
- Disclosed reports
- 16
- Subdomains
- 765
- Vendor on CyberSIXT
- Duckduckgo (4 CVEs, 0 exploited)
Most upvoted reports16
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| DOM XSS on duckduckgo.com searchAnalysed#868934 | No weakness recorded | 2020-06-14 | – | 326 |
| XXE on https://duckduckgo.comAnalysed#483774 | Injection and Smuggling | 2019-01-31 | – | 218 |
| SSRF on duckduckgo.com/iu/Analysed#398641 | Server-Side Request Forgery | 2018-09-09 | – | 165 |
| Partial bypass of #483774 with Blind XXE on https://duckduckgo.comAnalysed#486732 | Injection and Smuggling | 2019-02-25 | – | 159 |
| Reflected/Stored XSS on duckduckgo.comAnalysed#1110229 | Cross-site Scripting | 2021-04-10 | – | 135 |
| SSRF with bypass leads to client side hosting / vulnerabilities ( XSS and others )Analysed#3522157 | Server-Side Request Forgery | 2026-09-17 | $500 | 77 |
| DOM XSS on duckduckgo.com searchAnalysed#876148 | Cross-site Scripting | 2020-06-26 | – | 74 |
| XSS on Videos IAAnalysed#910427 | Cross-site Scripting | 2020-07-31 | – | 67 |
| RCE + PAT Exfiltration via pull_request_target in privacy-configuration/auto-respond-pr.yml — Direct Supply Chain to All DDG BrowsersAnalysed#3619288 | No weakness recorded | 2026-06-11 | – | 66 |
| RCE + Supply Chain Attack via pull_request_target in content-scope-scripts/semver-label.yml — Affects All DuckDuckGo BrowsersAnalysed#3619287 | No weakness recorded | 2026-06-11 | – | 41 |
Subdomains765
765 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.