Bug bounty program
MA
Mars
Most upvoted reports68
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Account Takeover in Password Reset FunctionAnalysed#3228888 | Authentication | 2025-09-02 | – | 105 |
| Reflected HTML Injection via contact (faq) search parameter on ██████████Analysed#2587101 | Cross-site Scripting | 2024-11-25 | – | 103 |
| █████████ when adding branches to your accountAnalysed#2756402 | Insecure Direct Object Reference | 2024-11-26 | – | 98 |
| Reflected HTML Injection via contact (faq) search parameter on ███]=Analysed#2578985 | Cross-site Scripting | 2024-11-25 | – | 82 |
| Unrestricted File Upload at ██████████Analysed#2357778 | File and Path Handling | 2024-02-19 | – | 78 |
| sqli on █████████ search functionalityAnalysed#2446550 | SQL Injection | 2024-06-25 | – | 72 |
| CVE-█████-35813 in █████Analysed#2200329 | File and Path Handling | 2026-02-24 | – | 71 |
| RXSS on ██████ via customerId parameterAnalysed#3126603 | Cross-site Scripting | 2025-07-28 | – | 71 |
| Unauthenticated Sensitive Information Disclosure on █████████ CVE-2021-38314Analysed#1452774 | Information Disclosure | 2025-09-02 | – | 67 |
| Upload profile photo and Pets addition - IDORAnalysed#2393021 | Insecure Direct Object Reference | 2024-11-21 | – | 66 |
Subdomains3,528
| Name | Scope | First seen |
|---|---|---|
| agnostic-dev.mars.comdev | In scope | 2026-11-14 |
| www.agnostic-dev.mars.comdev | In scope | 2026-11-14 |
| agnosticportalapi-dev.mars.comdev | In scope | 2026-11-14 |
| aimarta-dev.mars.comdev | In scope | 2026-11-14 |
| api-dev.mars.comapi, dev | In scope | 2026-11-14 |
| www.api-dev.mars.comapi, dev | In scope | 2026-11-14 |
| dev.brandsitedemo.mars.comdev | In scope | 2026-11-14 |
| dev.brandsiteguide.mars.comdev | In scope | 2026-11-14 |
| dev.customer.mars.comdev | In scope | 2026-11-14 |
| api-dev.snacking.dam.mars.comapi, dev | In scope | 2026-11-14 |
| dcomagent-dev.mars.comdev | In scope | 2026-11-14 |
| dev.mars.comdev | In scope | 2026-11-14 |
| dev-cdn-lighthouse.mars.comdev | In scope | 2026-11-14 |
| dev-fundraising.mars.comdev | In scope | 2026-11-14 |
| dev-infestationprogram.mars.comdev | In scope | 2026-11-14 |
| dev-info.mars.comdev | In scope | 2026-11-14 |
| dev-lighthouse.mars.comdev | In scope | 2026-11-14 |
| www.dev-lighthouse.mars.comdev | In scope | 2026-11-14 |
| dev-marsacss.mars.comdev | In scope | 2026-11-14 |
| dev-programainfestation.mars.comdev | In scope | 2026-11-14 |
| dev-src-cdn-lighthouse.mars.comdev | In scope | 2026-11-14 |
| dev-sustainability.mars.comdev | In scope | 2026-11-14 |
| brazil-rtm.dev.mars.comdev | In scope | 2026-11-14 |
| dev2-marsacss.mars.comdev | In scope | 2026-11-14 |
| developer-dev.mars.comdev | In scope | 2026-11-14 |
| dev.digitalhealthtools.mars.comdev | In scope | 2026-11-14 |
| epi-apiproxy-dev.mars.comdev | In scope | 2026-11-14 |
| epi-ns-dev.mars.comdev | In scope | 2026-11-14 |
| fac-api-dev.mars.comapi, dev | In scope | 2026-11-14 |
| fac-bot-dev.mars.comdev | In scope | 2026-11-14 |
| fac-webapp-dev.mars.comdev | In scope | 2026-11-14 |
| finiq-dev.mars.comdev | In scope | 2026-11-14 |
| globalspm-dev.mars.comdev | In scope | 2026-11-14 |
| iccc-bot-dev.mars.comdev | In scope | 2026-11-14 |
| iccc-webapp-dev.mars.comdev | In scope | 2026-11-14 |
| www.iccc-webapp-dev.mars.comdev | In scope | 2026-11-14 |
| innovationai-dev.mars.comdev | In scope | 2026-11-14 |
| www.innovationai-dev.mars.comdev | In scope | 2026-11-14 |
| lighthouse-api-dev.mars.comapi, dev | In scope | 2026-11-14 |
| www.lighthouse-api-dev.mars.comapi, dev | In scope | 2026-11-14 |
| lighthouse-dev.mars.comdev | In scope | 2026-11-14 |
| www.lighthouse-dev.mars.comdev | In scope | 2026-11-14 |
| mach-dev.mars.comdev | In scope | 2026-11-14 |
| marschampions-dev.mars.comdev | In scope | 2026-11-14 |
| www.marschampions-dev.mars.comdev | In scope | 2026-11-14 |
| dev.marta.mars.comdev | In scope | 2026-11-14 |
| mdw-dev-jobserver.mars.comdev | In scope | 2026-11-14 |
| www.mdw-dev-jobserver.mars.comdev | In scope | 2026-11-14 |
| neo-dev.mars.comdev | In scope | 2026-11-14 |
| www.neo-dev.mars.comdev | In scope | 2026-11-14 |
| or-webapp-dev.mars.comdev | In scope | 2026-11-14 |
| dev.risk.mars.comdev | In scope | 2026-11-14 |
| www.dev.risk.mars.comdev | In scope | 2026-11-14 |
| smc-dev.mars.comdev | In scope | 2026-11-14 |
| www.smc-dev.mars.comdev | In scope | 2026-11-14 |
| dev.termsandconditions.mars.comdev | In scope | 2026-11-14 |
3,528 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.