Skip to content
Connect AISign inSign up free

Bug bounty program

OP

OPPO

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
133
Disclosed reports
4
Subdomains
3,641
Vendor on CyberSIXT
OPPO (24 CVEs, 0 exploited)

Most upvoted reports4

Most upvoted reports of OPPO
ReportWeaknessDisclosedBountyVotes
Arbitrary thread deletion on c.realme.com#869705Insecure Direct Object Reference–$60073
Information Disclosure at https://portal.finzfin.com/1.txt#1011073Information Disclosure–$5020
No rate limit on Reporting a Threat on [https://community.coloros.com] lead to Increase in the User Group/Points#887684Input Validation and Logic–$10014
RXSS in https://store.oppomobile.com/#869870Cross-site Scripting–$10010

Subdomains3,641

Root:heytap.com
Scope
Name suggests
First seen
Text fileClear filters69 names
Subdomains of OPPO
NameScopeFirst seen
plboards.3-dropbox.r0.rule-album-cn01a.ocloud-test-8-ww1.tadpole-d.dsfs.authentication.ns.e.2016.heytap.comtestNot in the scope2026-11-14
account.heytap.comNot in the scope2026-11-14
aem.heytap.comNot in the scope2026-11-14
plboards.3-dropbox.r0.rule-album-cn01a.ocloud-test-plboards-euw-ww1.tadpole-d.dsfs.ns.apps-e.heytap.comtestNot in the scope2026-11-14
autodiscover.heytap.commailNot in the scope2026-11-14
bp.heytap.comNot in the scope2026-11-14
brand.heytap.comNot in the scope2026-11-14
ccp.heytap.comNot in the scope2026-11-14
chat.heytap.comNot in the scope2026-11-14
cloud.heytap.comNot in the scope2026-11-14
covideomc5.heytap.comNot in the scope2026-11-14
credit.heytap.comNot in the scope2026-11-14
credit-pre.heytap.comNot in the scope2026-11-14
danghuan.heytap.comNot in the scope2026-11-14
design.heytap.comNot in the scope2026-11-14
dm.heytap.comNot in the scope2026-11-14
e.heytap.comNot in the scope2026-11-14
e-id.heytap.comNot in the scope2026-11-14
epicac.3-dropbox.r0.rule-album-trafficn01a01a.ocloud-test-8-ww1.tool.tadpole-d.ns.e.e.heytap.comtestNot in the scope2026-11-14
mysql6.3-dropbox.r0.rule-album-trafficn01a01a.ocloud-test-8-ww1.tool.tadpole-d.ns.e.e.heytap.comdata, testNot in the scope2026-11-14
3-dropbox.r0.rule-album-cn01a.ocloud-test-8-ww1-mail.tadpole-d.dockerjinx.ns.e.heytap.commail, testNot in the scope2026-11-14
plboards.3-dropbox.r0.rule-album-cn0tadpole-d-nova.ocloud-test-8-wwtadpole-d-nov.tadpole-d.dsfs-paywall.ns.e.heytap.comtestNot in the scope2026-11-14
gusty.fwplboards.3-dropbox.r0.rule-album-cn01a.ocloud-test-8-ww1-cn01cloud.tadpole-d.dsfs.ns.e.heytap.comtestNot in the scope2026-11-14
magnesium.3-dropbox.r0.rule-album-cn01a.ocloud-test-8-ww1.tadpole-d.dsfs.ns.e.heytap.comtestNot in the scope2026-11-14
plboards.3-dropbox.r0.rule-album-cn01a.ocloud-test-8-ww1.tadpole-d.dsfs.ns.e.heytap.comtestNot in the scope2026-11-14
3-dropbox.r0.rule-album-cn01a.homepage.grupper.ns.e.heytap.comNot in the scope2026-11-14
3-dropbox.r0.rule-album-cn01a.anakin.tadpole-d.ns.e.heytap.comNot in the scope2026-11-14
3-dropbox.r0.rule-album-cn01a.homepage.tadpole-d.ns.e.heytap.comNot in the scope2026-11-14
3-dropboxjinx.r0.rule-album-cn01a.ocloud-test-8-payments.tadpole-d.ns.e.heytap.comtestNot in the scope2026-11-14
3-dropbox.r0.rule-album-cn01a.ocloud-test-8-ww1.tadpole-d.ns.e.heytap.comtestNot in the scope2026-11-14
3-dropboxjinx.r0.rule-album-cn01a.ocloud-test-8-ww1evelynn.tadpole-d.ns.e.heytap.comtestNot in the scope2026-11-14
sm3na.r0.rule-album-cn01a.opreyihuandl-8-ww1.tadpole-d.ns.e.heytap.comNot in the scope2026-11-14
3-dropbox.r0.rule-album-cn01a.ocloud-test-8-ww1.tadpole-d.ns.otafsg1-az.e.heytap.comtestNot in the scope2026-11-14
3-dropboxjinx.r0.rule-amarketingum-cn01a.ocloud-test-8-ww1evelynn.tadpole-d.ns.ecms1.heytap.comtestNot in the scope2026-11-14
finance.heytap.comNot in the scope2026-11-14
find.heytap.comNot in the scope2026-11-14
gamefile.heytap.comNot in the scope2026-11-14
www.google.com-94e3ff-machine-machine-honors-engine.gitlab.heytap.comgitNot in the scope2026-11-14
health.heytap.comNot in the scope2026-11-14
htsg-payapi-sg.heytap.comNot in the scope2026-11-14
htsg-storeapi-sg.heytap.comNot in the scope2026-11-14
htsg-storegateway-sg.heytap.comNot in the scope2026-11-14
id.heytap.comIn scope2026-11-14
imap.heytap.commailNot in the scope2026-11-14
msec.heytap.comNot in the scope2026-11-14
muc.heytap.comNot in the scope2026-11-14
pay.heytap.comNot in the scope2026-11-14
payment.heytap.comNot in the scope2026-11-14
pc.heytap.comNot in the scope2026-11-14
pc-in.heytap.comNot in the scope2026-11-14
qpon.heytap.comNot in the scope2026-11-14
rydeen-qpon-gl.heytap.comNot in the scope2026-11-14
safe.heytap.comIn scope2026-11-14
smtp.heytap.commailNot in the scope2026-11-14
st.heytap.comNot in the scope2026-11-14
store.heytap.comNot in the scope2026-11-14
lax13-dropboxjinx.r0.rule-album-cn01a.ocloud-test-8-ww1evelynn.tadpole-d.ns.teaccountst-e.heytap.comtestNot in the scope2026-11-14
tech.heytap.comNot in the scope2026-11-14
titan.heytap.comNot in the scope2026-11-14
u.heytap.comNot in the scope2026-11-14
uat-brand.heytap.comtestNot in the scope2026-11-14
usercenter.heytap.comNot in the scope2026-11-14
vip.heytap.comNot in the scope2026-11-14
wj.heytap.comNot in the scope2026-11-14
wj-in.heytap.comNot in the scope2026-11-14
wj-sg.heytap.comNot in the scope2026-11-14
www.heytap.comNot in the scope2026-11-14
wwwtest.heytap.comNot in the scope2026-11-14
zhongbao.heytap.comIn scope2026-11-14

16 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated