Bug bounty program · HackerOne
Most upvoted reports47
- #3124517ValidAnalysedArbitrary Read of Another Users private repository without AuthorizationGitHub · Insecure Direct Object Reference · 2025 · High · needs: a user account · IDOR / object reference, Missing authorisation check$10,000276votes
- #1711938ValidGithub Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL apiGitHub · Access Control · 2023–198votes
- #2579939ValidSAML Signature verification bypass allows logging into any user (with specific conditions)GitHub · Access Control · 2024 · Critical–196votes
- #1901040ValidAuthentication bypass on gist.github.com through SSH CertificatesGitHub · Access Control · 2023$10,000182votes
- #1497169ValidCSRF protection bypass in GitHub Enterprise management consoleGitHub · Cross-Site Request Forgery · 2022$10,000152votes
- #3560256ValidCross-repository IDOR in `/settings/security_analysis/bypass_reviewers` allows unauthorized delegated bypass reviewer modificationGitHub · Insecure Direct Object Reference · 2026 · Medium–108votes
- #3713965ValidAble to bypass authorization logic and gain more access then intendedGitHub · No weakness recorded · 2026 · Medium–105votes
- #2501036ValidAccess body and title of Internal Repo Issues in ProjectsGitHub · Information Disclosure · 2024 · Medium–100votes
- #1732595ValidGithub app Privilege Escalation to Administrator/Owner of the OrganizationGitHub · Access Control · 2023–98votes
- #3506183ValidMissing Access Control in MigrationFile allows attacker to upload files to any MigrationGitHub · Insecure Direct Object Reference · 2026 · High–92votes
Subdomains56,442
661 covered by the program's own scope · 0 first seen this week
Roots:github.com 55,670 · 3 in scopegithub.net 330 · 330 in scopegithubapp.com 328 · 328 in scopesemmle.com 63githubassets.com 24semmle.net 18lgtm.com 8githubwebhooks.net 1
540 names
| Name | Scope | First seen |
|---|---|---|
| graphql.16.github.comapi | Not in the scope | 2026-11-14 |
| antivirus.graphql.16.github.comapi | Not in the scope | 2026-11-14 |
| 1api.github.comapi | Not in the scope | 2026-11-14 |
| graphql.2.github.comapi | Not in the scope | 2026-11-14 |
| antivirus.graphql.2.github.comapi | Not in the scope | 2026-11-14 |
| graphql.2010.github.comapi | Not in the scope | 2026-11-14 |
| antivirus.graphql.2010.github.comapi | Not in the scope | 2026-11-14 |
| graphql.2013.github.comapi | Not in the scope | 2026-11-14 |
| antivirus.graphql.2013.github.comapi | Not in the scope | 2026-11-14 |
| 21805486855-curl-api.github.comapi | Not in the scope | 2026-11-14 |
| ghes-3.6-diff-to-api.github.comapi | Not in the scope | 2026-11-14 |
| types-openapi-ghes-3.6-diff-to-api.github.comapi | Not in the scope | 2026-11-14 |
| webservice.abhinavmishra14.github.comapi | Not in the scope | 2026-11-14 |
| types-openapi-github.ae-diff-to-api.github.comapi, git | Not in the scope | 2026-11-14 |
| aimclaw-host-gh-only-api.github.comapi | Not in the scope | 2026-11-14 |
| alice-scoped-to-api.github.comapi | Not in the scope | 2026-11-14 |
| wswithoutdi02.webservices.alien11689.github.comapi | Not in the scope | 2026-11-14 |
| api.alive.github.comapi | Not in the scope | 2026-11-14 |
| all-api.github.comapi | Not in the scope | 2026-11-14 |
| allow-api.github.comapi | Not in the scope | 2026-11-14 |
| api.antivirus.github.comapi | Not in the scope | 2026-11-14 |
| api-docs.antivirus.github.comapi | Not in the scope | 2026-11-14 |
| swagger.antivirus.github.comapi | Not in the scope | 2026-11-14 |
| api.github.comapi | In scope | 2026-11-14 |
| api-1.github.comapi | Not in the scope | 2026-11-14 |
| api-1ep06--1ep06-100-0-1-5.github.comapi | Not in the scope | 2026-11-14 |
| api-antivirus.github.comapi | Not in the scope | 2026-11-14 |
| api-dev.github.comapi, dev | Not in the scope | 2026-11-14 |
| api-dict.github.comapi | Not in the scope | 2026-11-14 |
| api-docs.github.comapi | Not in the scope | 2026-11-14 |
| api-docs-antivirus.github.comapi | Not in the scope | 2026-11-14 |
| api-docs-covid19.github.comapi | Not in the scope | 2026-11-14 |
| antivirus.api-docs.github.comapi | Not in the scope | 2026-11-14 |
| covid19.api-docs.github.comapi | Not in the scope | 2026-11-14 |
| sigmavirus24.api-docs.github.comapi | Not in the scope | 2026-11-14 |
| virus.api-docs.github.comapi | Not in the scope | 2026-11-14 |
| api-docscovid19.github.comapi | Not in the scope | 2026-11-14 |
| api-foo.github.comapi | Not in the scope | 2026-11-14 |
| api-gh-pr.github.comapi | Not in the scope | 2026-11-14 |
| api-git-status.github.comapi, git, monitoring | Not in the scope | 2026-11-14 |
| api-i.github.comapi | Not in the scope | 2026-11-14 |
| api-stars.github.comapi | Not in the scope | 2026-11-14 |
| api-test.github.comapi, test | Not in the scope | 2026-11-14 |
| api-v2.github.comapi | Not in the scope | 2026-11-14 |
| api-v3.github.comapi | Not in the scope | 2026-11-14 |
| _cisco-uds.api.github.comapi | Not in the scope | 2026-11-14 |
| _collab-edge.api.github.comapi | Not in the scope | 2026-11-14 |
| _cuplogin.api.github.comapi | Not in the scope | 2026-11-14 |
| _dmarc.api.github.comapi | Not in the scope | 2026-11-14 |
| _mta-sts.api.github.comapi | Not in the scope | 2026-11-14 |
| _tcp.api.github.comapi | Not in the scope | 2026-11-14 |
| _cisco-uds._tcp.api.github.comapi | Not in the scope | 2026-11-14 |
| _cuplogin._tcp.api.github.comapi | Not in the scope | 2026-11-14 |
| a.api.github.comapi | Not in the scope | 2026-11-14 |
| acapi.api.github.comapi | Not in the scope | 2026-11-14 |
| akamai.api.github.comapi | Not in the scope | 2026-11-14 |
| akamai-test.api.github.comapi, test | Not in the scope | 2026-11-14 |
| api.api.github.comapi | Not in the scope | 2026-11-14 |
| app.api.github.comapi | Not in the scope | 2026-11-14 |
| assets.api.github.comapi | Not in the scope | 2026-11-14 |
| atem.api.github.comapi | Not in the scope | 2026-11-14 |
| auth.api.github.comapi, auth | Not in the scope | 2026-11-14 |
| autoconfig.api.github.comapi | Not in the scope | 2026-11-14 |
| autodiscover.api.github.comapi, mail | Not in the scope | 2026-11-14 |
| awsdashboard.api.github.comapi | Not in the scope | 2026-11-14 |
| b.api.github.comapi | Not in the scope | 2026-11-14 |
| basic.api.github.comapi | Not in the scope | 2026-11-14 |
| basic-nodejs-dev.api.github.comapi, dev | Not in the scope | 2026-11-14 |
| beta.api.github.comapi, staging | Not in the scope | 2026-11-14 |
| blog.api.github.comapi | Not in the scope | 2026-11-14 |
| c.api.github.comapi | Not in the scope | 2026-11-14 |
| careers.api.github.comapi | Not in the scope | 2026-11-14 |
| cdn.api.github.comapi | Not in the scope | 2026-11-14 |
| cert.api.github.comapi | Not in the scope | 2026-11-14 |
| cim-api.api.github.comapi | Not in the scope | 2026-11-14 |
| cim-api-dev.api.github.comapi, dev | Not in the scope | 2026-11-14 |
| cim-api-qa.api.github.comapi, test | Not in the scope | 2026-11-14 |
| cim-api-uat.api.github.comapi, test | Not in the scope | 2026-11-14 |
| cim-data-quality-qa.api.github.comapi, test | Not in the scope | 2026-11-14 |
| cim-dev.api.github.comapi, dev | Not in the scope | 2026-11-14 |
| citrix.api.github.comapi, vpn | Not in the scope | 2026-11-14 |
| code.api.github.comapi | Not in the scope | 2026-11-14 |
| collab.api.github.comapi | Not in the scope | 2026-11-14 |
| consul.api.github.comapi, tools | Not in the scope | 2026-11-14 |
| copilot.api.github.comapi | Not in the scope | 2026-11-14 |
| covid19.api.github.comapi | Not in the scope | 2026-11-14 |
| bash.curl.api.github.comapi | Not in the scope | 2026-11-14 |
| custom.api.github.comapi | Not in the scope | 2026-11-14 |
| cveapi.api.github.comapi | Not in the scope | 2026-11-14 |
| danieapp.api.github.comapi | Not in the scope | 2026-11-14 |
| db.api.github.comapi, data | Not in the scope | 2026-11-14 |
| dc.api.github.comapi | Not in the scope | 2026-11-14 |
| de.api.github.comapi | Not in the scope | 2026-11-14 |
| deep.api.github.comapi | Not in the scope | 2026-11-14 |
| dmarc.api.github.comapi | Not in the scope | 2026-11-14 |
| dnm.api.github.comapi | Not in the scope | 2026-11-14 |
| dns.api.github.comapi | Not in the scope | 2026-11-14 |
| dns1.api.github.comapi | Not in the scope | 2026-11-14 |
| dns2.api.github.comapi | Not in the scope | 2026-11-14 |
| docs.api.github.comapi | Not in the scope | 2026-11-14 |
Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. See the subdomains on the Atlas or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.