Skip to content
Connect AISign inSign up free

Bug bounty program

OP

OPPO

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
133
Disclosed reports
4
Subdomains
3,641
Vendor on CyberSIXT
OPPO (24 CVEs, 0 exploited)

Most upvoted reports4

Most upvoted reports of OPPO
ReportWeaknessDisclosedBountyVotes
Arbitrary thread deletion on c.realme.com#869705Insecure Direct Object Reference–$60073
Information Disclosure at https://portal.finzfin.com/1.txt#1011073Information Disclosure–$5020
No rate limit on Reporting a Threat on [https://community.coloros.com] lead to Increase in the User Group/Points#887684Input Validation and Logic–$10014
RXSS in https://store.oppomobile.com/#869870Cross-site Scripting–$10010

Subdomains3,641

Root:finzfin.com
Scope
Name suggests
First seen
Text fileClear filters48 names
Subdomains of OPPO
NameScopeFirst seen
jewelry.wire.community.distribuidorinzfin.ocard-gray.com-origin.finzfin.comNot in the scope2026-11-14
staging.wire.community.distribuidorinzfin.ocard-gray.com-origin.finzfin.comstagingNot in the scope2026-11-14
staging.wire.community.distribuidorinzfin.events-ocard-gray.com.finzfin.comstagingNot in the scope2026-11-14
staging.wire.community.distribuidorinzfin.ocard-gray.com.finzfin.comstagingNot in the scope2026-11-14
whmcsstagew4-tor-apidocsstaging-magzineimg3-assets-gopher.wire.community.distribuidorinzfin.ocard-gray.com.finzfin.comNot in the scope2026-11-14
epoch.finzfin.comNot in the scope2026-11-14
epoch-in.finzfin.comNot in the scope2026-11-14
epoch-sg.finzfin.comNot in the scope2026-11-14
fast-wallet.finzfin.comNot in the scope2026-11-14
gslb.finzfin.comNot in the scope2026-11-14
www.google.com.help.help.finzfin.comNot in the scope2026-11-14
www.google.comtraining.help.help.finzfin.comNot in the scope2026-11-14
www.google.com-ioxd-scfcontainer.proxy-iactivity.historyapiserver-pre-developproxy.finzfin.comNot in the scope2026-11-14
www.google.com-ioxd-scfcontainer.docs.historynativepay-pre-developproxy.finzfin.comNot in the scope2026-11-14
www.google.com-ioxd-cwalletprivate.gw-proxy-iactivity-magzineimg2.historynativepay-pre-developproxy.finzfin.comNot in the scope2026-11-14
www.google.com-ioxd-scfcontainerprivate.com-ioxd-cwalletprivate.proxy-iactivity.historynativepay-pre-developproxy.finzfin.comNot in the scope2026-11-14
www.google.com-ioxd-cwalletprivate.proxy-iactivity.historynativepay-pre-developproxy.finzfin.comNot in the scope2026-11-14
www.google.com-ioxd-scfcontainer-k8s-prod.proxy-iactivity.historynativepay-pre-developproxy.finzfin.comtoolsNot in the scope2026-11-14
www.google.com-ioxd-scfcontaineraccountingate-authorization.proxy-iactivity.historynativepay-pre-developproxy.finzfin.comNot in the scope2026-11-14
www.google.com-ioxd-scfcontainerprivate.proxy-iactivity.historynativepay-pre-developproxy.finzfin.comNot in the scope2026-11-14
www.google.com-ioxd-scfcontaineraccountingate.proxy-iactivity.historynativepay-pre-iloanshop-preproxy.finzfin.comNot in the scope2026-11-14
www.google.com-ioxd-scfcontainer-k8s-prod.proxy-iactivity.historytrial-pre-developproxy.finzfin.comtoolsNot in the scope2026-11-14
hwallet.finzfin.comNot in the scope2026-11-14
i.finzfin.comNot in the scope2026-11-14
i-insurance.finzfin.comNot in the scope2026-11-14
img.finzfin.comNot in the scope2026-11-14
iwallet.finzfin.comNot in the scope2026-11-14
iwealth.finzfin.comNot in the scope2026-11-14
loanshop.finzfin.comNot in the scope2026-11-14
loanshop-gray.finzfin.comNot in the scope2026-11-14
loanshop-ht.finzfin.comNot in the scope2026-11-14
www.google.com-ioxd-scfcontainer.proxy-iactivity.marketapiserver-pre-developproxybilling.finzfin.comNot in the scope2026-11-14
seitsm.nfc.finzfin.comNot in the scope2026-11-14
portal.finzfin.comNot in the scope2026-11-14
www.google.com.gist.mirror.k8s-prd.proxy-prod.finzfin.comtoolsNot in the scope2026-11-14
rinsurance.finzfin.comNot in the scope2026-11-14
rloanshop.finzfin.comNot in the scope2026-11-14
rplatform.finzfin.comNot in the scope2026-11-14
rwallet.finzfin.comNot in the scope2026-11-14
rwallet-gray.finzfin.comNot in the scope2026-11-14
rwealth.finzfin.comNot in the scope2026-11-14
sentry.finzfin.commonitoringNot in the scope2026-11-14
spgw-pay.finzfin.comNot in the scope2026-11-14
tepoch.finzfin.comNot in the scope2026-11-14
www.google.com-administratorment-cms.tepoch-authorization-prod.finzfin.comadminNot in the scope2026-11-14
ticket.finzfin.comNot in the scope2026-11-14
transit-callback.finzfin.comNot in the scope2026-11-14
www.finzfin.comNot in the scope2026-11-14

16 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated