Bug bounty program
OP
OPPO
Most upvoted reports4
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Arbitrary thread deletion on c.realme.com#869705 | Insecure Direct Object Reference | – | $600 | 73 |
| Information Disclosure at https://portal.finzfin.com/1.txt#1011073 | Information Disclosure | – | $50 | 20 |
| No rate limit on Reporting a Threat on [https://community.coloros.com] lead to Increase in the User Group/Points#887684 | Input Validation and Logic | – | $100 | 14 |
| RXSS in https://store.oppomobile.com/#869870 | Cross-site Scripting | – | $100 | 10 |
Subdomains3,641
| Name | Scope | First seen |
|---|---|---|
| ads.heytapmobile.com | Not in the scope | 2026-11-14 |
| ads-bdapi-my.heytapmobile.com | Not in the scope | 2026-11-14 |
| ads-bdapi-ph.heytapmobile.com | Not in the scope | 2026-11-14 |
| ads-bdapi-th.heytapmobile.com | Not in the scope | 2026-11-14 |
| ads-bdapi-vn.heytapmobile.com | Not in the scope | 2026-11-14 |
| adx-f.ads.heytapmobile.com | Not in the scope | 2026-11-14 |
| adx-id.ads.heytapmobile.com | Not in the scope | 2026-11-14 |
| adx-in.ads.heytapmobile.com | Not in the scope | 2026-11-14 |
| adx-kh.ads.heytapmobile.com | Not in the scope | 2026-11-14 |
| adx-mm.ads.heytapmobile.com | Not in the scope | 2026-11-14 |
| adx-my.ads.heytapmobile.com | Not in the scope | 2026-11-14 |
| adx-ph.ads.heytapmobile.com | Not in the scope | 2026-11-14 |
| adx-sg.ads.heytapmobile.com | Not in the scope | 2026-11-14 |
| adx-th.ads.heytapmobile.com | Not in the scope | 2026-11-14 |
| adx-tw.ads.heytapmobile.com | Not in the scope | 2026-11-14 |
| adx-vn.ads.heytapmobile.com | Not in the scope | 2026-11-14 |
| bdapi-id.ads.heytapmobile.com | Not in the scope | 2026-11-14 |
| bdapi-in.ads.heytapmobile.com | Not in the scope | 2026-11-14 |
| cl-data-id.ads.heytapmobile.com | Not in the scope | 2026-11-14 |
| stg-data-f.ads.heytapmobile.comstaging | Not in the scope | 2026-11-14 |
| stg-data-id.ads.heytapmobile.comstaging | Not in the scope | 2026-11-14 |
| stg-data-in.ads.heytapmobile.comstaging | Not in the scope | 2026-11-14 |
| stg-data-kh.ads.heytapmobile.comstaging | Not in the scope | 2026-11-14 |
| stg-data-mm.ads.heytapmobile.comstaging | Not in the scope | 2026-11-14 |
| stg-data-my.ads.heytapmobile.comstaging | Not in the scope | 2026-11-14 |
| stg-data-ph.ads.heytapmobile.comstaging | Not in the scope | 2026-11-14 |
| stg-data-sg.ads.heytapmobile.comstaging | Not in the scope | 2026-11-14 |
| stg-data-th.ads.heytapmobile.comstaging | Not in the scope | 2026-11-14 |
| stg-data-tw.ads.heytapmobile.comstaging | Not in the scope | 2026-11-14 |
| stg-data-vn.ads.heytapmobile.comstaging | Not in the scope | 2026-11-14 |
| t-in.ads.heytapmobile.com | Not in the scope | 2026-11-14 |
| ait.heytapmobile.com | Not in the scope | 2026-11-14 |
| album-in01a-ocloud.heytapmobile.com | Not in the scope | 2026-11-14 |
| appconf-eu.heytapmobile.com | Not in the scope | 2026-11-14 |
| appconf-in.heytapmobile.com | Not in the scope | 2026-11-14 |
| appconf-sgp.heytapmobile.com | Not in the scope | 2026-11-14 |
| apps.heytapmobile.com | Not in the scope | 2026-11-14 |
| as.heytapmobile.com | Not in the scope | 2026-11-14 |
| bot.heytapmobile.com | Not in the scope | 2026-11-14 |
| browser.heytapmobile.com | Not in the scope | 2026-11-14 |
| cloudi-in.browser.heytapmobile.com | Not in the scope | 2026-11-14 |
| cloudi-sg.browser.heytapmobile.com | Not in the scope | 2026-11-14 |
| cloudi-th.browser.heytapmobile.com | Not in the scope | 2026-11-14 |
| cloudi-vn.browser.heytapmobile.com | Not in the scope | 2026-11-14 |
| i-in.browser.heytapmobile.com | Not in the scope | 2026-11-14 |
| i-sg.browser.heytapmobile.com | Not in the scope | 2026-11-14 |
| i-th.browser.heytapmobile.com | Not in the scope | 2026-11-14 |
| i-vn.browser.heytapmobile.com | Not in the scope | 2026-11-14 |
| iflow-in.browser.heytapmobile.com | Not in the scope | 2026-11-14 |
| iflow-sg.browser.heytapmobile.com | Not in the scope | 2026-11-14 |
| iflow-th.browser.heytapmobile.com | Not in the scope | 2026-11-14 |
| iflow-vn.browser.heytapmobile.com | Not in the scope | 2026-11-14 |
| kernellog-sg.browser.heytapmobile.com | Not in the scope | 2026-11-14 |
| bsp-di-in.heytapmobile.com | Not in the scope | 2026-11-14 |
| bsp-di-us.heytapmobile.com | Not in the scope | 2026-11-14 |
| captcha-ind-sec.heytapmobile.com | Not in the scope | 2026-11-14 |
| captcha-sec-gl.heytapmobile.com | Not in the scope | 2026-11-14 |
| captcha-sgp-sec.heytapmobile.com | Not in the scope | 2026-11-14 |
| cc.heytapmobile.com | Not in the scope | 2026-11-14 |
| cdo.heytapmobile.com | Not in the scope | 2026-11-14 |
| api-gl.cdo.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-id.cdo.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-in.cdo.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| epoch-gl.cdo.heytapmobile.com | Not in the scope | 2026-11-14 |
| epoch-id.cdo.heytapmobile.com | Not in the scope | 2026-11-14 |
| epoch-in.cdo.heytapmobile.com | Not in the scope | 2026-11-14 |
| epoch-my.cdo.heytapmobile.com | Not in the scope | 2026-11-14 |
| epoch-ph.cdo.heytapmobile.com | Not in the scope | 2026-11-14 |
| epoch-tw.cdo.heytapmobile.com | Not in the scope | 2026-11-14 |
| epoch-vn.cdo.heytapmobile.com | Not in the scope | 2026-11-14 |
| cloud.heytapmobile.com | Not in the scope | 2026-11-14 |
| cloudkit-api-in.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| conf-in-dc.heytapmobile.com | Not in the scope | 2026-11-14 |
| cpc.heytapmobile.com | Not in the scope | 2026-11-14 |
| u-id.cpc.heytapmobile.com | Not in the scope | 2026-11-14 |
| u-in.cpc.heytapmobile.com | Not in the scope | 2026-11-14 |
| u-th.cpc.heytapmobile.com | Not in the scope | 2026-11-14 |
| dc.heytapmobile.com | Not in the scope | 2026-11-14 |
| dc-conf-eu.heytapmobile.com | Not in the scope | 2026-11-14 |
| dc-conf-in.heytapmobile.com | Not in the scope | 2026-11-14 |
| dc-dragate-sg.heytapmobile.com | Not in the scope | 2026-11-14 |
| dc-stat-in.heytapmobile.com | Not in the scope | 2026-11-14 |
| obus-in.dc.heytapmobile.com | Not in the scope | 2026-11-14 |
| obus-sg.dc.heytapmobile.com | Not in the scope | 2026-11-14 |
| dcc-awareness-in.heytapmobile.com | Not in the scope | 2026-11-14 |
| dragate-in-dc.heytapmobile.com | Not in the scope | 2026-11-14 |
| event-sg-dc.heytapmobile.com | Not in the scope | 2026-11-14 |
| finz.heytapmobile.com | Not in the scope | 2026-11-14 |
| game.heytapmobile.com | Not in the scope | 2026-11-14 |
| api-id.game.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-in.game.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-my.game.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-ph.game.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-th.game.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-vn.game.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| gamesdk.heytapmobile.com | Not in the scope | 2026-11-14 |
| health.heytapmobile.com | Not in the scope | 2026-11-14 |
| aps-sport.health.heytapmobile.com | Not in the scope | 2026-11-14 |
| india-sport.health.heytapmobile.com | Not in the scope | 2026-11-14 |
| sport.health.heytapmobile.com | Not in the scope | 2026-11-14 |
16 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.