Bug bounty program
DU
DuckDuckGo
Most upvoted reports16
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| DOM XSS on duckduckgo.com searchAnalysed#868934 | No weakness recorded | 2020-06-14 | – | 326 |
| XXE on https://duckduckgo.comAnalysed#483774 | Injection and Smuggling | 2019-01-31 | – | 218 |
| SSRF on duckduckgo.com/iu/Analysed#398641 | Server-Side Request Forgery | 2018-09-09 | – | 165 |
| Partial bypass of #483774 with Blind XXE on https://duckduckgo.comAnalysed#486732 | Injection and Smuggling | 2019-02-25 | – | 159 |
| Reflected/Stored XSS on duckduckgo.comAnalysed#1110229 | Cross-site Scripting | 2021-04-10 | – | 135 |
| SSRF with bypass leads to client side hosting / vulnerabilities ( XSS and others )Analysed#3522157 | Server-Side Request Forgery | 2026-09-17 | $500 | 77 |
| DOM XSS on duckduckgo.com searchAnalysed#876148 | Cross-site Scripting | 2020-06-26 | – | 74 |
| XSS on Videos IAAnalysed#910427 | Cross-site Scripting | 2020-07-31 | – | 67 |
| RCE + PAT Exfiltration via pull_request_target in privacy-configuration/auto-respond-pr.yml — Direct Supply Chain to All DDG BrowsersAnalysed#3619288 | No weakness recorded | 2026-06-11 | – | 66 |
| RCE + Supply Chain Attack via pull_request_target in content-scope-scripts/semver-label.yml — Affects All DuckDuckGo BrowsersAnalysed#3619287 | No weakness recorded | 2026-06-11 | – | 41 |
Subdomains765
| Name | Scope | First seen |
|---|---|---|
| dev-test.duckduckgo.comdev, test | In scope | 2026-11-14 |
| tim-test.duckduckgo.comtest | In scope | 2026-11-14 |
| eric-test.duckduckgo.comtest | In scope | 2026-11-14 |
| test-pinto.duckduckgo.comtest | In scope | 2026-11-14 |
| va-testing1.duckduckgo.comtest | In scope | 2026-11-14 |
| testing.netp.duckduckgo.comtest | In scope | 2026-11-14 |
| va-bastion-test1.duckduckgo.comtest | In scope | 2026-11-14 |
| va-bastion1-test.duckduckgo.comtest | In scope | 2026-11-14 |
| test.usc.ddgindex.duckduckgo.comtest | In scope | 2026-11-14 |
| test.use.ddgindex.duckduckgo.comtest | In scope | 2026-11-14 |
| api.xl.ase.sandbox.duckduckgo.comapi, test | In scope | 2026-11-14 |
| api.xl.dew.sandbox.duckduckgo.comapi, test | In scope | 2026-11-14 |
| api.xl.usc.sandbox.duckduckgo.comapi, test | In scope | 2026-11-14 |
| api.cluster.dew.sandbox.duckduckgo.comapi, test | In scope | 2026-11-14 |
| api.ddgindex.usc.sandbox.duckduckgo.comapi, test | In scope | 2026-11-14 |
| api.ddgindex.use.sandbox.duckduckgo.comapi, test | In scope | 2026-11-14 |
| tikv-proxy-test.apps.use.ddgindex.duckduckgo.comtest | In scope | 2026-11-14 |
| legacy-issuer-test.apps.use.ddgindex.duckduckgo.comlegacy, test | In scope | 2026-11-14 |
| tikv-proxy.apps.ddgindex.use.sandbox.duckduckgo.comtest | In scope | 2026-11-14 |
| transactional-emails.internal-sandbox.duckduckgo.cominternal, test | In scope | 2026-11-14 |
765 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.