Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
34
Disclosed reports
14
Subdomains
19,861
Vendor on CyberSIXT
Elastic (415 CVEs, 3 exploited)

Most upvoted reports14

All reports
Most upvoted reports of Elastic
ReportWeaknessDisclosedBountyVotes
Prototype Pollution leads to XSS on https://blog.swiftype.com/#__proto__[asd]=alert(document.domain)Analysed#998398Cross-site Scripting2021-08-16–157
CVE-2021-40870 on [52.204.160.31]Analysed#1356845Command and Code Injection2021-10-06–75
Critical || Unrestricted access to private Github repos and properties of Elastic through leaked token of Elastic employeeAnalysed#1266188Cryptography2021-09-01–64
blind Server-Side Request Forgery (SSRF) allows scanning internal portsAnalysed#1300585Server-Side Request Forgery2023-05-05–54
Synthetics Recorder: Code injection when recording website with malicious contentAnalysed#1636382Command and Code Injection2023-04-08–47
CSRF in AppSearch allows creation of "curations"Analysed#1477050Cross-Site Request Forgery2022-11-17–35
RCE hazard in reporting (via Chromium)#1168765Access Control2021-05-26$10,00025
Improper authorization on `/api/as/v1/credentials/` for Dev Role User with Limited Engine Access#1218680Access Control2021-08-03–21
Remote Code Execution in coming Kibana 7.7.0#861744Access Control2021-04-19$5,00014
Improper authorization on `/api/as/v1/credentials/` allows any App Search user to access all API keys and escalate privileges#1168528Access Control2021-06-02–13

Subdomains19,861

Subdomains of Elastic
NameScopeFirst seen
adl-common-mfaf-stg.kb.japaneast.azure.elastic-cloud.comstagingNot in the scope2026-11-14
ansible-staging-logging.elastic.comonitoring, stagingIn scope2026-11-14
apm-agent-versions-staging.elastic.comonitoring, stagingIn scope2026-11-14
apm-latest-agents-version-staging.elastic.comonitoring, stagingIn scope2026-11-14
artifacts-staging.elastic.costagingIn scope2026-11-14
aws-eu-central-1-logging-staging-cloud.elastic.comonitoring, stagingIn scope2026-11-14
aws-eu-central-1-metering-monitor-staging-cloud.elastic.comonitoring, stagingIn scope2026-11-14
aws-eu-central-1-metering-staging-cloud.elastic.costagingIn scope2026-11-14
aws-eu-central-1-metrics-staging-cloud.elastic.comonitoring, stagingIn scope2026-11-14
aws-eu-central-1-monitor-staging-cloud.elastic.comonitoring, stagingIn scope2026-11-14
azure-eastus2-logging-staging-cloud.elastic.comonitoring, stagingIn scope2026-11-14
azure-eastus2-metrics-staging-cloud.elastic.comonitoring, stagingIn scope2026-11-14
azure-eastus2-monitor-staging-cloud.elastic.comonitoring, stagingIn scope2026-11-14
bekitzur-staging.elastic.costagingIn scope2026-11-14
clacheck-staging.elastic.costagingIn scope2026-11-14
clachecker-staging.elastic.costagingIn scope2026-11-14
cloud-api-preview.elastic.coapi, stagingIn scope2026-11-14
cloud-api-staging.elastic.coapi, stagingIn scope2026-11-14
cloud-preview.elastic.costagingIn scope2026-11-14
cloud-preview-api.elastic.coapi, stagingIn scope2026-11-14
cloud-staging-api.elastic.coapi, stagingIn scope2026-11-14
email.staging-ess.cloud.elastic.costagingIn scope2026-11-14
demo-staging.elastic.costaging, testIn scope2026-11-14
staging.demo.elastic.costaging, testIn scope2026-11-14
blue.staging.demo.elastic.costaging, testIn scope2026-11-14
esql.staging.demo.elastic.costaging, testIn scope2026-11-14
esql-workshop.staging.demo.elastic.costaging, testIn scope2026-11-14
green.staging.demo.elastic.costaging, testIn scope2026-11-14
nginx.staging.demo.elastic.costaging, testIn scope2026-11-14
otel.staging.demo.elastic.costaging, testIn scope2026-11-14
relevance-workbench.staging.demo.elastic.costaging, testIn scope2026-11-14
docs-staging.elastic.costagingIn scope2026-11-14
download-staging.elastic.costagingIn scope2026-11-14
download-stats-staging.elastic.costagingIn scope2026-11-14
epr-staging.elastic.costagingIn scope2026-11-14
feeds-staging.elastic.costagingIn scope2026-11-14
found-api-preview.elastic.coapi, stagingIn scope2026-11-14
found-api-staging.elastic.coapi, stagingIn scope2026-11-14
found-staging.elastic.costagingIn scope2026-11-14
gcp-us-central1-logging-staging-cloud.elastic.comonitoring, stagingIn scope2026-11-14
gcp-us-central1-metrics-staging-cloud.elastic.comonitoring, stagingIn scope2026-11-14
gcp-us-central1-monitor-staging-cloud.elastic.comonitoring, stagingIn scope2026-11-14
github-stats-staging.elastic.cogit, stagingIn scope2026-11-14
go-staging.elastic.costagingIn scope2026-11-14
ibm-dal-p00-logging-staging-cloud.elastic.comonitoring, stagingIn scope2026-11-14
ibm-dal-p00-metrics-staging-cloud.elastic.comonitoring, stagingIn scope2026-11-14
ibm-dal-p00-monitor-staging-cloud.elastic.comonitoring, stagingIn scope2026-11-14
infra-cdn-director-staging.elastic.costagingIn scope2026-11-14
infra-cdn-staging.elastic.costagingIn scope2026-11-14
license-files-staging.elastic.codata, stagingIn scope2026-11-14
license-staging.elastic.costagingIn scope2026-11-14
email.email.license-staging.elastic.costagingIn scope2026-11-14
maps-staging.elastic.costagingIn scope2026-11-14
catalogue-staging.maps.elastic.costagingIn scope2026-11-14
vector-staging.maps.elastic.costagingIn scope2026-11-14
ml-models-staging.elastic.costagingIn scope2026-11-14
oss-dependencies-staging.elastic.costagingIn scope2026-11-14
oss-staging-dependencies.elastic.costagingIn scope2026-11-14
register-staging.elastic.costagingIn scope2026-11-14
staging.sa.elastic.costagingIn scope2026-11-14
demo.staging.sa.elastic.costaging, testIn scope2026-11-14
sa-demo-apachelogs.staging.sa.elastic.costaging, testIn scope2026-11-14
sa-demo-arcsight.staging.sa.elastic.costaging, testIn scope2026-11-14
sa-demo-canvas.staging.sa.elastic.costaging, testIn scope2026-11-14
sa-demo-cyclops.staging.sa.elastic.costaging, testIn scope2026-11-14
sa-demo-cyclops-kibana.staging.sa.elastic.comonitoring, staging, testIn scope2026-11-14
sa-demo-ece.staging.sa.elastic.costaging, testIn scope2026-11-14
127-103.sa-demo-ece.staging.sa.elastic.costaging, testIn scope2026-11-14
bocailuntan12yuanbaicai.sa-demo-ece.staging.sa.elastic.costaging, testIn scope2026-11-14
sa-demo-honeypot-kibana.staging.sa.elastic.comonitoring, staging, testIn scope2026-11-14
sa-demo-iot.staging.sa.elastic.costaging, testIn scope2026-11-14
sa-demo-kibana.staging.sa.elastic.comonitoring, staging, testIn scope2026-11-14
sa-demo-ml.staging.sa.elastic.costaging, testIn scope2026-11-14
sa-demo-operations.staging.sa.elastic.costaging, testIn scope2026-11-14
sa-demo-racing.staging.sa.elastic.costaging, testIn scope2026-11-14
sa-demo-sec18.staging.sa.elastic.costaging, testIn scope2026-11-14
sa-demo-security.staging.sa.elastic.costaging, testIn scope2026-11-14
sa-demo-sql.staging.sa.elastic.costaging, testIn scope2026-11-14
staging.elastic.costagingIn scope2026-11-14
email.staging-alerts.elastic.costagingIn scope2026-11-14
staging-deepthought.elastic.costagingIn scope2026-11-14
staging-discuss.elastic.costagingIn scope2026-11-14
staging-oauth-test.elastic.coauth, staging, testIn scope2026-11-14
staging-us-east-1-cloud-logging.elastic.comonitoring, stagingIn scope2026-11-14
staging-website.elastic.costagingIn scope2026-11-14
beta.support.elastic.costagingIn scope2026-11-14
telemetry-staging.elastic.costagingIn scope2026-11-14
kibana.telemetry-staging.elastic.comonitoring, stagingIn scope2026-11-14
tiles-maps-stage.elastic.costagingIn scope2026-11-14
tiles-stage.elastic.costagingIn scope2026-11-14
us-east-1-logging-staging-cloud.elastic.comonitoring, stagingIn scope2026-11-14
us-east-1-metrics-staging-cloud.elastic.comonitoring, stagingIn scope2026-11-14
us-east-1-monitor-staging-cloud.elastic.comonitoring, stagingIn scope2026-11-14
us-east-1-staging-cloud-monitor.elastic.comonitoring, stagingIn scope2026-11-14
workflows-staging.elastic.costagingIn scope2026-11-14
cloud-pricing-staging.app.elstc.costagingIn scope2026-11-14
docs-preview.app.elstc.costagingIn scope2026-11-14
elasticsearch-php_999.docs-preview.app.elstc.codata, stagingIn scope2026-11-14
elasticsearch_51017.docs-preview.app.elstc.codata, stagingIn scope2026-11-14
elasticsearch_53170.docs-preview.app.elstc.codata, stagingIn scope2026-11-14

17,372 names are covered by the program's own scope; 5 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.