Bug bounty program

DuckDuckGo

Platform: HackerOne
Bounties: None
Assets in scope: 4
Disclosed reports: 16
Subdomains: 765

Most upvoted reports16

Most upvoted reports of DuckDuckGo
Report	Weakness	Disclosed	Bounty	Votes
DOM XSS on duckduckgo.com searchAnalysed#868934	No weakness recorded	2020-06-14	–	326
XXE on https://duckduckgo.comAnalysed#483774	Injection and Smuggling	2019-01-31	–	218
SSRF on duckduckgo.com/iu/Analysed#398641	Server-Side Request Forgery	2018-09-09	–	165
Partial bypass of #483774 with Blind XXE on https://duckduckgo.comAnalysed#486732	Injection and Smuggling	2019-02-25	–	159
Reflected/Stored XSS on duckduckgo.comAnalysed#1110229	Cross-site Scripting	2021-04-10	–	135
SSRF with bypass leads to client side hosting / vulnerabilities ( XSS and others )Analysed#3522157	Server-Side Request Forgery	2026-09-17	$500	77
DOM XSS on duckduckgo.com searchAnalysed#876148	Cross-site Scripting	2020-06-26	–	74
XSS on Videos IAAnalysed#910427	Cross-site Scripting	2020-07-31	–	67
RCE + PAT Exfiltration via pull_request_target in privacy-configuration/auto-respond-pr.yml — Direct Supply Chain to All DDG BrowsersAnalysed#3619288	No weakness recorded	2026-06-11	–	66
RCE + Supply Chain Attack via pull_request_target in content-scope-scripts/semver-label.yml — Affects All DuckDuckGo Browsers#3619287	No weakness recorded	2026-06-11	–	41

Subdomains765

Root

duckduckgo.com765

Scope

Name suggests:Source code

First seen

Text fileClear filters4 names

Subdomains of DuckDuckGo
Name	Scope	First seen
eun-github.duckduckgo.comgit	In scope	2026-11-14
va-github1.duckduckgo.comgit	In scope	2026-11-14
use-github1.duckduckgo.comgit	In scope	2026-11-14
usermanagent-github.duckduckgo.comgit	In scope	2026-11-14

765 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.