Bug bounty program
EX
Exodus
Most upvoted reports3
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Cache Poisoning DoS on downloads.exodus.comAnalysed#1173153 | Denial of Service | 2021-12-22 | – | 110 |
| Exposed Configuration Files at https://www.exodus.io/keybase.txt#1027949 | No weakness recorded | 2020-11-06 | – | 18 |
| 2 Cache Poisoning Attack Methods Affect Core Functionality www.exodus.com#1581454 | No weakness recorded | 2022-06-06 | – | 7 |
Subdomains202
| Name | Scope | First seen |
|---|---|---|
| get.exodus.com | Listed out of scope | 2026-11-14 |
| slack-invite.exodus.com | Listed out of scope | 2026-11-14 |
| support.exodus.com | Listed out of scope | 2026-11-14 |
| www.exodus.com | Listed out of scope | 2026-11-14 |
| safeguard.a.exodus.io | Listed out of scope | 2026-11-14 |
| support-helpers.a.exodus.io | Listed out of scope | 2026-11-14 |
| get.exodus.io | Listed out of scope | 2026-11-14 |
195 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.