Skip to content
Sign in

Bug bounty program

DU

DuckDuckGo

Open on HackerOneAtlas
Platform
HackerOne
Bounties
None
Assets in scope
4
Disclosed reports
16
Subdomains
765

Most upvoted reports16

All reports
Most upvoted reports of DuckDuckGo
ReportWeaknessDisclosedBountyVotes
DOM XSS on duckduckgo.com searchAnalysed#868934No weakness recorded2020-06-14–326
XXE on https://duckduckgo.comAnalysed#483774Injection and Smuggling2019-01-31–218
SSRF on duckduckgo.com/iu/Analysed#398641Server-Side Request Forgery2018-09-09–165
Partial bypass of #483774 with Blind XXE on https://duckduckgo.comAnalysed#486732Injection and Smuggling2019-02-25–159
Reflected/Stored XSS on duckduckgo.comAnalysed#1110229Cross-site Scripting2021-04-10–135
SSRF with bypass leads to client side hosting / vulnerabilities ( XSS and others )#3522157Server-Side Request Forgery2026-09-17$50077
DOM XSS on duckduckgo.com search#876148Cross-site Scripting2020-06-26–74
XSS on Videos IA#910427Cross-site Scripting2020-07-31–67
RCE + PAT Exfiltration via pull_request_target in privacy-configuration/auto-respond-pr.yml — Direct Supply Chain to All DDG Browsers#3619288No weakness recorded2026-06-11–66
RCE + Supply Chain Attack via pull_request_target in content-scope-scripts/semver-label.yml — Affects All DuckDuckGo Browsers#3619287No weakness recorded2026-06-11–41

Subdomains765

Root
Scope
Name suggests:Development
First seen
Text fileClear filters21 names
Subdomains of DuckDuckGo
NameScopeFirst seen
va-dev6.duckduckgo.comdevIn scope2026-11-14
dev-test.duckduckgo.comdev, testIn scope2026-11-14
dev-turn.duckduckgo.comdevIn scope2026-11-14
va-dev10.duckduckgo.comdevIn scope2026-11-14
va-dev23.duckduckgo.comdevIn scope2026-11-14
va-dev39.duckduckgo.comdevIn scope2026-11-14
va-dev47.duckduckgo.comdevIn scope2026-11-14
va-dev58.duckduckgo.comdevIn scope2026-11-14
va-dev59.duckduckgo.comdevIn scope2026-11-14
va-dev61.duckduckgo.comdevIn scope2026-11-14
dev-turn2.duckduckgo.comdevIn scope2026-11-14
kibana-dev.duckduckgo.comdev, monitoringIn scope2026-11-14
amiseed-dev.duckduckgo.comdevIn scope2026-11-14
dev-sync-use.duckduckgo.comdevIn scope2026-11-14
logstash-dev.duckduckgo.comdevIn scope2026-11-14
use-dev-logstash.duckduckgo.comdevIn scope2026-11-14
subscriptions-dev.duckduckgo.comdevIn scope2026-11-14
duckassist-docker-dev.duckduckgo.comdev, toolsIn scope2026-11-14
internal-subscriptions-dev.duckduckgo.comdev, internalIn scope2026-11-14
clickhouse-dev.usc.ddgindex.duckduckgo.comdata, devIn scope2026-11-14
d98625b3-120a-402a-be2b-92775cc9989c-dev.duckduckgo.comdevIn scope2026-11-14

765 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in