Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
28
Disclosed reports
3
Subdomains
202
Vendor on CyberSIXT
Exodus (1 CVE, 0 exploited)

Most upvoted reports3

Most upvoted reports of Exodus
ReportWeaknessDisclosedBountyVotes
Cache Poisoning DoS on downloads.exodus.comAnalysed#1173153Denial of Service2021-12-22–110
Exposed Configuration Files at https://www.exodus.io/keybase.txt#1027949No weakness recorded2020-11-06–18
2 Cache Poisoning Attack Methods Affect Core Functionality www.exodus.com#1581454No weakness recorded2022-06-06–7

Subdomains202

Subdomains of Exodus
NameScopeFirst seen
agents.exodus.comIn scope2026-11-14
aggregator-docs.exodus.comIn scope2026-11-14
ai.exodus.comIn scope2026-11-14
admin.ai.exodus.comadminIn scope2026-11-14
data.ai.exodus.comIn scope2026-11-14
events.ai.exodus.comIn scope2026-11-14
hilva.ai.exodus.comIn scope2026-11-14
horizon.ai.exodus.comvpnIn scope2026-11-14
inference.ai.exodus.comIn scope2026-11-14
knowledge.ai.exodus.comIn scope2026-11-14
team.ai.exodus.comIn scope2026-11-14
workspaces.ai.exodus.comIn scope2026-11-14
xqa.ai.exodus.comIn scope2026-11-14
xqa-artifacts.ai.exodus.comIn scope2026-11-14
xqa-next.ai.exodus.comIn scope2026-11-14
xqa-public.ai.exodus.comIn scope2026-11-14
blog.exodus.comIn scope2026-11-14
checkout.exodus.comIn scope2026-11-14
checkout-admin.exodus.comadminIn scope2026-11-14
checkout-api.exodus.comapiIn scope2026-11-14
checkout-dashboard.exodus.comadminIn scope2026-11-14
checkout-demo.exodus.comtestIn scope2026-11-14
crypto-pill-playground.exodus.comIn scope2026-11-14
crypto-pill-playground-d.exodus.comIn scope2026-11-14
dev.exodus.comdevIn scope2026-11-14
docs.exodus.comIn scope2026-11-14
downloads.exodus.comIn scope2026-11-14
email.exodus.comIn scope2026-11-14
extension.exodus.comIn scope2026-11-14
get.exodus.comListed out of scope2026-11-14
help.exodus.comIn scope2026-11-14
investors.exodus.comIn scope2026-11-14
keys.exodus.comIn scope2026-11-14
link.exodus.comIn scope2026-11-14
link-t.exodus.comIn scope2026-11-14
login.exodus.comauthIn scope2026-11-14
metadata.exodus.comIn scope2026-11-14
mirror.exodus.comIn scope2026-11-14
ns3.exodus.comIn scope2026-11-14
ot.exodus.comIn scope2026-11-14
abc-vikas.ot.exodus.comIn scope2026-11-14
ai-gateway-d.ot.exodus.comIn scope2026-11-14
aig-cloudflare-d.ot.exodus.comIn scope2026-11-14
aig-native-869-d.ot.exodus.comIn scope2026-11-14
deck.ot.exodus.comIn scope2026-11-14
devops-handbook.ot.exodus.comIn scope2026-11-14
eng-handbook.ot.exodus.comIn scope2026-11-14
engineer-handbook.ot.exodus.comIn scope2026-11-14
exodus-enam-cdn.ot.exodus.comIn scope2026-11-14
exokit.ot.exodus.comIn scope2026-11-14
exotest.ot.exodus.comIn scope2026-11-14
inference.ot.exodus.comIn scope2026-11-14
inference-cloudflare-d.ot.exodus.comIn scope2026-11-14
inference-d.ot.exodus.comIn scope2026-11-14
inference-next-d.ot.exodus.comIn scope2026-11-14
it-handbook.ot.exodus.comIn scope2026-11-14
knowledge-d.ot.exodus.comIn scope2026-11-14
knowledge-portal-d.ot.exodus.comIn scope2026-11-14
scam-hitlist.ot.exodus.comIn scope2026-11-14
security-handbook.ot.exodus.comIn scope2026-11-14
sunflower.ot.exodus.comIn scope2026-11-14
passkeys-network-d.exodus.comIn scope2026-11-14
pm-bounces.exodus.comIn scope2026-11-14
referrals.exodus.comIn scope2026-11-14
slack-invite.exodus.comListed out of scope2026-11-14
support.exodus.comListed out of scope2026-11-14
support-lt.exodus.comIn scope2026-11-14
turing.exodus.comIn scope2026-11-14
uk.exodus.comIn scope2026-11-14
updates.exodus.comIn scope2026-11-14
url4664.exodus.comIn scope2026-11-14
wallet.exodus.comIn scope2026-11-14
wallet-d.exodus.comIn scope2026-11-14
www.exodus.comListed out of scope2026-11-14

195 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.