Bug bounty program · HackerOne
Most upvoted reports257
- #827052ValidAnalysedArbitrary file read via the UploadsRewriter when moving and issueGitLab · File and Path Handling · 2020 · needs: a user account · Path traversal, Local file inclusion$20,0001,503votes
- #2293343ValidAnalysedAccount Takeover via Password Reset without user interactionsGitLab · Access Control · 2025 · Critical · needs: no account · Account takeover chain, Password reset flaw, Parameter pollution$35,000989votes
- #658013ValidAnalysedGit flag injection - local file overwrite to remote code executionGitLab · Command and Code Injection · 2019 · needs: a user account · OS command injection, Path traversal$12,000777votes
- #446585ValidAnalysedExfiltrate and mutate repository and project data through injected templated serviceGitLab · Access Control · 2019 · needs: a user account · Missing authorisation check, Information disclosure, SSRF$11,000762votes
- #526325ValidAnalysedStored XSS in Wiki pagesGitLab · Cross-site Scripting · 2019 · needs: a user account · Stored XSS–633votes
- #587854ValidAnalysedLocal files could be overwritten in GitLab, leading to remote command executionGitLab · Command and Code Injection · 2019 · needs: a user account · Path traversal, OS command injection$12,000542votes
- #1154542ValidAnalysedRCE when removing metadata with ExifToolGitLab · Command and Code Injection · 2021 · needs: a user account · Code injection / eval, Unsafe file upload$20,000508votes
- #689314ValidAnalysedProject Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requestsGitLab · Access Control · 2019 · needs: a user account · Missing authorisation check, IDOR / object reference, Privilege escalation$12,000457votes
- #1125425ValidAnalysedRCE via unsafe inline Kramdown options when rendering certain Wiki pagesGitLab · Command and Code Injection · 2021 · needs: a user account · Code injection / eval$20,000427votes
- #850447ValidAnalysedgitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be readGitLab · Information Disclosure · 2020 · needs: a user account · Missing authorisation check, Information disclosure, Path traversal$10,000410votes
Subdomains785
6 covered by the program's own scope · 0 first seen this week
Name suggestsAnything
785 names
| Name | Scope | First seen |
|---|---|---|
| a.gitlab.com | Not in the scope | 2026-11-14 |
| about.gitlab.com | In scope | 2026-11-14 |
| about-src.gitlab.com | Not in the scope | 2026-11-14 |
| www.about-src.gitlab.com | Not in the scope | 2026-11-14 |
| release-8-16.about.gitlab.com | Not in the scope | 2026-11-14 |
| www.about.gitlab.com | Not in the scope | 2026-11-14 |
| advisories.gitlab.com | In scope | 2026-11-14 |
| search.advisories.gitlab.com | Not in the scope | 2026-11-14 |
| alerts.gitlab.com | Listed out of scope | 2026-11-14 |
| www.alerts.gitlab.com | Not in the scope | 2026-11-14 |
| altssh.gitlab.com | Not in the scope | 2026-11-14 |
| analytics.gitlab.com | Not in the scope | 2026-11-14 |
| api.gitlab.comapi | Not in the scope | 2026-11-14 |
| app.gitlab.com | Not in the scope | 2026-11-14 |
| aptly.gitlab.com | Listed out of scope | 2026-11-14 |
| www.aptly.gitlab.com | Not in the scope | 2026-11-14 |
| arewefastyet.gitlab.com | Not in the scope | 2026-11-14 |
| artifact-registry.gitlab.comtools | Not in the scope | 2026-11-14 |
| assets.gitlab.com | Not in the scope | 2026-11-14 |
| ldap01.ath.gitlab.com | Not in the scope | 2026-11-14 |
| ldap02.ath.gitlab.com | Not in the scope | 2026-11-14 |
| ldap03.ath.gitlab.com | Not in the scope | 2026-11-14 |
| auth.gitlab.comauth | Not in the scope | 2026-11-14 |
| auth.aws.gitlab.comauth | Not in the scope | 2026-11-14 |
| biz.gitlab.com | Not in the scope | 2026-11-14 |
| blackbox.gitlab.com | Not in the scope | 2026-11-14 |
| blah.gitlab.com | Not in the scope | 2026-11-14 |
| blog.gitlab.com | Not in the scope | 2026-11-14 |
| www.blog.gitlab.com | Not in the scope | 2026-11-14 |
| cachet.gitlab.com | Not in the scope | 2026-11-14 |
| campaign-manager.gitlab.comadmin | Not in the scope | 2026-11-14 |
| canary.gitlab.comstaging | Not in the scope | 2026-11-14 |
| www.canary.gitlab.comstaging | Not in the scope | 2026-11-14 |
| cdn.gitlab.com | Not in the scope | 2026-11-14 |
| ce.gitlab.com | Not in the scope | 2026-11-14 |
| www.ce.gitlab.com | Not in the scope | 2026-11-14 |
| cells.gitlab.com | Not in the scope | 2026-11-14 |
| grafana.amp.cells.gitlab.commonitoring | Not in the scope | 2026-11-14 |
| cell-c01j2gdw0zfdafxr6.cells.gitlab.com | Not in the scope | 2026-11-14 |
| grafana.cell-c01j2gdw0zfdafxr6.cells.gitlab.commonitoring | Not in the scope | 2026-11-14 |
| kas.cell-c01j2gdw0zfdafxr6.cells.gitlab.com | Not in the scope | 2026-11-14 |
| opensearch.cell-c01j2gdw0zfdafxr6.cells.gitlab.com | Not in the scope | 2026-11-14 |
| registry.cell-c01j2gdw0zfdafxr6.cells.gitlab.comtools | Not in the scope | 2026-11-14 |
| us-east1.cell-c01j2gdw0zfdafxr6.cells.gitlab.com | Not in the scope | 2026-11-14 |
| grafana.us-east1.cell-c01j2gdw0zfdafxr6.cells.gitlab.commonitoring | Not in the scope | 2026-11-14 |
| kas.us-east1.cell-c01j2gdw0zfdafxr6.cells.gitlab.com | Not in the scope | 2026-11-14 |
| opensearch.us-east1.cell-c01j2gdw0zfdafxr6.cells.gitlab.com | Not in the scope | 2026-11-14 |
| registry.us-east1.cell-c01j2gdw0zfdafxr6.cells.gitlab.comtools | Not in the scope | 2026-11-14 |
| cell-c01k35wpsh58x0j74g.cells.gitlab.com | Not in the scope | 2026-11-14 |
| grafana.cell-c01k35wpsh58x0j74g.cells.gitlab.commonitoring | Not in the scope | 2026-11-14 |
| kas.cell-c01k35wpsh58x0j74g.cells.gitlab.com | Not in the scope | 2026-11-14 |
| opensearch.cell-c01k35wpsh58x0j74g.cells.gitlab.com | Not in the scope | 2026-11-14 |
| prometheus.cell-c01k35wpsh58x0j74g.cells.gitlab.commonitoring | Not in the scope | 2026-11-14 |
| registry.cell-c01k35wpsh58x0j74g.cells.gitlab.comtools | Not in the scope | 2026-11-14 |
| us-east-1.cell-c01k35wpsh58x0j74g.cells.gitlab.com | Not in the scope | 2026-11-14 |
| grafana.us-east-1.cell-c01k35wpsh58x0j74g.cells.gitlab.commonitoring | Not in the scope | 2026-11-14 |
| kas.us-east-1.cell-c01k35wpsh58x0j74g.cells.gitlab.com | Not in the scope | 2026-11-14 |
| opensearch.us-east-1.cell-c01k35wpsh58x0j74g.cells.gitlab.com | Not in the scope | 2026-11-14 |
| prometheus.us-east-1.cell-c01k35wpsh58x0j74g.cells.gitlab.commonitoring | Not in the scope | 2026-11-14 |
| registry.us-east-1.cell-c01k35wpsh58x0j74g.cells.gitlab.comtools | Not in the scope | 2026-11-14 |
| cell-c01m4b3pkb8zqewe56.cells.gitlab.com | Not in the scope | 2026-11-14 |
| grafana.cell-c01m4b3pkb8zqewe56.cells.gitlab.commonitoring | Not in the scope | 2026-11-14 |
| kas.cell-c01m4b3pkb8zqewe56.cells.gitlab.com | Not in the scope | 2026-11-14 |
| opensearch.cell-c01m4b3pkb8zqewe56.cells.gitlab.com | Not in the scope | 2026-11-14 |
| prometheus.cell-c01m4b3pkb8zqewe56.cells.gitlab.commonitoring | Not in the scope | 2026-11-14 |
| registry.cell-c01m4b3pkb8zqewe56.cells.gitlab.comtools | Not in the scope | 2026-11-14 |
| us-east-1.cell-c01m4b3pkb8zqewe56.cells.gitlab.com | Not in the scope | 2026-11-14 |
| grafana.us-east-1.cell-c01m4b3pkb8zqewe56.cells.gitlab.commonitoring | Not in the scope | 2026-11-14 |
| kas.us-east-1.cell-c01m4b3pkb8zqewe56.cells.gitlab.com | Not in the scope | 2026-11-14 |
| opensearch.us-east-1.cell-c01m4b3pkb8zqewe56.cells.gitlab.com | Not in the scope | 2026-11-14 |
| prometheus.us-east-1.cell-c01m4b3pkb8zqewe56.cells.gitlab.commonitoring | Not in the scope | 2026-11-14 |
| registry.us-east-1.cell-c01m4b3pkb8zqewe56.cells.gitlab.comtools | Not in the scope | 2026-11-14 |
| centos-test.gitlab.comtest | Not in the scope | 2026-11-14 |
| chat.gitlab.com | Not in the scope | 2026-11-14 |
| www.chat.gitlab.com | Not in the scope | 2026-11-14 |
| chef.gitlab.com | Not in the scope | 2026-11-14 |
| swedish.chef.gitlab.com | Not in the scope | 2026-11-14 |
| www.swedish.chef.gitlab.com | Not in the scope | 2026-11-14 |
| www.chef.gitlab.com | Not in the scope | 2026-11-14 |
| chef12.gitlab.com | Not in the scope | 2026-11-14 |
| chef2.gitlab.com | Not in the scope | 2026-11-14 |
| ci.gitlab.comci | Not in the scope | 2026-11-14 |
| www.ci.gitlab.comci | Not in the scope | 2026-11-14 |
| cinc.gitlab.com | Not in the scope | 2026-11-14 |
| cloud.gitlab.com | Not in the scope | 2026-11-14 |
| ai-gateway-eks.cloud.gitlab.com | Not in the scope | 2026-11-14 |
| cocreate.gitlab.com | Not in the scope | 2026-11-14 |
| code.gitlab.com | Not in the scope | 2026-11-14 |
| codesuggestions.gitlab.com | Not in the scope | 2026-11-14 |
| api.community.gitlab.comapi | Not in the scope | 2026-11-14 |
| api-staging.community.gitlab.comapi, staging | Not in the scope | 2026-11-14 |
| app.community.gitlab.com | Not in the scope | 2026-11-14 |
| app-staging.community.gitlab.comstaging | Not in the scope | 2026-11-14 |
| go-staging.community.gitlab.comstaging | Not in the scope | 2026-11-14 |
| manager-staging.community.gitlab.comadmin, staging | Not in the scope | 2026-11-14 |
| content.gitlab.com | Not in the scope | 2026-11-14 |
| contributors.gitlab.com | Not in the scope | 2026-11-14 |
| www.contributors.gitlab.com | Not in the scope | 2026-11-14 |
| cron.gitlab.com | Not in the scope | 2026-11-14 |
| 2670515-review-enable-aut-a96d5t.cust-staging.gitlab.comstaging | Not in the scope | 2026-11-14 |
Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. See the subdomains on the Atlas.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.