Bug bounty program
OP
OPPO
Most upvoted reports4
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Arbitrary thread deletion on c.realme.com#869705 | Insecure Direct Object Reference | – | $600 | 73 |
| Information Disclosure at https://portal.finzfin.com/1.txt#1011073 | Information Disclosure | – | $50 | 20 |
| No rate limit on Reporting a Threat on [https://community.coloros.com] lead to Increase in the User Group/Points#887684 | Input Validation and Logic | – | $100 | 14 |
| RXSS in https://store.oppomobile.com/#869870 | Cross-site Scripting | – | $100 | 10 |
Subdomains3,641
| Name | Scope | First seen |
|---|---|---|
| com-cdn-tomcat-machine-xcx2rd-myflowers.1.oppo.cn | Not in the scope | 2026-11-14 |
| com-cdn-homedoctorvisits-hdverifyelblax-carton-homecdn.com-cdn-tomcat-machine-xcx2rd-myflowers.1.oppo.cn | Not in the scope | 2026-11-14 |
| www.google.com-cloud-desktop-server.1.oppo.cn | Not in the scope | 2026-11-14 |
| www.google.com-cloud-hdverify-google-learning-mylonelypussyelb.com-cloud-enginevpn-platform-myseat-engine.1.oppo.cn | Not in the scope | 2026-11-14 |
| www.google.com-cloud-surveyfs-platform-learning-engine.com-cloud-hdverify-google-learning-appleidelb.1.oppo.cn | Not in the scope | 2026-11-14 |
| www.google.com-cloud-hybrid-machine-12-engine.1.oppo.cn | Not in the scope | 2026-11-14 |
| www.google.com-cloud-lightcrypto.1.oppo.cn | Not in the scope | 2026-11-14 |
| www.google.com-cloud-map2110-l1.1.oppo.cn | Not in the scope | 2026-11-14 |
| bvs4j4jpg8nlbceqgto0.a245090.com-cloud-homedoctorvisits-hdverifyelblax-carton-homecloud.com-cloud-pretest-machine-williamahuston-google.1.oppo.cn | Not in the scope | 2026-11-14 |
| www.google.com-cloud-enginezfs-cartonelblaxvpn-learning-engine.hybrid.1.oppo.cn | Not in the scope | 2026-11-14 |
| bvrsdquuc7d04a0216t0.webproxy.idcjxbf.1.oppo.cn | Not in the scope | 2026-11-14 |
| www.google.com-cloud-krw.pt.1.oppo.cn | Not in the scope | 2026-11-14 |
| www.google.com-cloud-homenitorprod-machine-learning-engine.sourceprod.1.oppo.cn | Not in the scope | 2026-11-14 |
| www.google.com-cloud-button-11-i-thread-engineelb.12.oppo.cn | Not in the scope | 2026-11-14 |
| www.google.com-cloud-platform-16-enginevpn-button.12.oppo.cn | Not in the scope | 2026-11-14 |
| www.google.com-cloud-platform-hdtwitch-learning-enginepaymentfs.9.oppo.cn | Not in the scope | 2026-11-14 |
| www.google.com-cloud-platform-xcx2rdprod2-learning-enginepayment.9.oppo.cn | Not in the scope | 2026-11-14 |
| admin.oppo.cnadmin | Not in the scope | 2026-11-14 |
| adminwx.oppo.cn | Not in the scope | 2026-11-14 |
| i.api.oppo.cnapi | Not in the scope | 2026-11-14 |
| bbs.oppo.cn | Not in the scope | 2026-11-14 |
| beta.oppo.cnstaging | Not in the scope | 2026-11-14 |
| www.google.com-cloud-surveyelb-engineprodprod-myaccount-google.cdnw.oppo.cn | Not in the scope | 2026-11-14 |
| www.google.com-cloud-11payment-10-learning-enginepaymentprodmrc-mbu.cms1.oppo.cnadmin | Not in the scope | 2026-11-14 |
| coloros.oppo.cn | Not in the scope | 2026-11-14 |
| ossapihd.comm.oppo.cn | Not in the scope | 2026-11-14 |
| emm.oppo.cn | Not in the scope | 2026-11-14 |
| exapi.oppo.cn | Not in the scope | 2026-11-14 |
| fswx.oppo.cn | Not in the scope | 2026-11-14 |
| hd.oppo.cn | Not in the scope | 2026-11-14 |
| hdapi.oppo.cn | Not in the scope | 2026-11-14 |
| hdpage.oppo.cn | Not in the scope | 2026-11-14 |
| hdstatic.oppo.cn | Not in the scope | 2026-11-14 |
| hdstatic2.oppo.cn | Not in the scope | 2026-11-14 |
| i-api.oppo.cnapi | Not in the scope | 2026-11-14 |
| i-msg.oppo.cn | Not in the scope | 2026-11-14 |
| i-thread.oppo.cn | Not in the scope | 2026-11-14 |
| i-user.oppo.cn | Not in the scope | 2026-11-14 |
| id.oppo.cn | Not in the scope | 2026-11-14 |
| wx.api.images.oppo.cnapi | Not in the scope | 2026-11-14 |
| imgfs.oppo.cn | Not in the scope | 2026-11-14 |
| imgfs2.oppo.cn | Not in the scope | 2026-11-14 |
| iservice.oppo.cn | Not in the scope | 2026-11-14 |
| leyuan.oppo.cn | Not in the scope | 2026-11-14 |
| m.oppo.cn | Not in the scope | 2026-11-14 |
| i.msg.oppo.cn | Not in the scope | 2026-11-14 |
| ofans.oppo.cn | Not in the scope | 2026-11-14 |
| oia.oppo.cn | Not in the scope | 2026-11-14 |
| open.oppo.cn | Not in the scope | 2026-11-14 |
| ossapihd-comm.oppo.cn | Not in the scope | 2026-11-14 |
| paike.oppo.cn | Not in the scope | 2026-11-14 |
| pre-wx-admin.oppo.cnadmin | Not in the scope | 2026-11-14 |
| pretest.oppo.cn | Not in the scope | 2026-11-14 |
| previp.oppo.cn | Not in the scope | 2026-11-14 |
| service.oppo.cn | Not in the scope | 2026-11-14 |
| survey.oppo.cn | Not in the scope | 2026-11-14 |
| surveyfs.oppo.cn | Not in the scope | 2026-11-14 |
| surveyfs-origin-268360.oppo.cn | Not in the scope | 2026-11-14 |
| i.thread.oppo.cn | Not in the scope | 2026-11-14 |
| update2021.oppo.cn | Not in the scope | 2026-11-14 |
| api.update2021.oppo.cnapi | Not in the scope | 2026-11-14 |
| i.user.oppo.cn | Not in the scope | 2026-11-14 |
| vip.oppo.cn | Not in the scope | 2026-11-14 |
| vipapi.oppo.cn | Not in the scope | 2026-11-14 |
| vodfs.oppo.cn | Not in the scope | 2026-11-14 |
| www.google.com-cloud-platform-i-signprod-learning-i-sign.com-cloud-1-engineengine-learning-engine.w.oppo.cn | Not in the scope | 2026-11-14 |
| www.oppo.cn | Not in the scope | 2026-11-14 |
| wx.oppo.cn | Not in the scope | 2026-11-14 |
| wxapi.oppo.cn | Not in the scope | 2026-11-14 |
| wximg.oppo.cn | Not in the scope | 2026-11-14 |
| wxmsg.oppo.cn | Not in the scope | 2026-11-14 |
| xcx.oppo.cn | Not in the scope | 2026-11-14 |
| xcx3rd.oppo.cn | Not in the scope | 2026-11-14 |
16 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.