Bug bounty program · HackerOne
Most upvoted reports5
- #1083923ValidSharing products with Mail allows phishing attacks due to misconfiguration.OpenMage · Input Validation and Logic · 2021–38votes
- #1085743ValidNo error thrown when IDOR attempted while editing addressOpenMage · Misconfiguration and Insecure Design · 2021–33votes
- #1086752ValidCSRF in changing password after using reset password linkOpenMage · Cross-Site Request Forgery · 2021–24votes
- #1091957ValidVery long names on demo.openmage.org could redirect victim users to malicious url redirects via email contacts.OpenMage · Information Disclosure · 2021–14votes
- #1085079ValidNo Limit on Email SubscriptionOpenMage · Denial of Service · 2021–12votes
Subdomains7
1 covered by the program's own scope · 0 first seen this week
7 names
| Name | Scope | First seen |
|---|---|---|
| demo.openmage.orgtest | In scope | 2026-11-14 |
| demo-admin.openmage.orgadmin, test | Not in the scope | 2026-11-14 |
| docs.openmage.org | Not in the scope | 2026-11-14 |
| migrate.openmage.org | Not in the scope | 2026-11-14 |
| nginxdemo.openmage.org | Not in the scope | 2026-11-14 |
| nginxdemo-admin.openmage.orgadmin | Not in the scope | 2026-11-14 |
| www.openmage.org | Listed out of scope | 2026-11-14 |
Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. See the subdomains on the Atlas or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.