Bug bounty program
OP
OPPO
Most upvoted reports4
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Arbitrary thread deletion on c.realme.com#869705 | Insecure Direct Object Reference | – | $600 | 73 |
| Information Disclosure at https://portal.finzfin.com/1.txt#1011073 | Information Disclosure | – | $50 | 20 |
| No rate limit on Reporting a Threat on [https://community.coloros.com] lead to Increase in the User Group/Points#887684 | Input Validation and Logic | – | $100 | 14 |
| RXSS in https://store.oppomobile.com/#869870 | Cross-site Scripting | – | $100 | 10 |
Subdomains3,641
| Name | Scope | First seen |
|---|---|---|
| www.google.com-conn2-origin-373da1.v1-com-conn2-origin-373da1-samurai-qa.05swag-tester-shared.oppopay.comtest | Not in the scope | 2026-11-14 |
| www.google.com-conn2-origin-373da1.v1.05swag-tester-sharedwebsvcreal-swag-tester.oppopay.com | Not in the scope | 2026-11-14 |
| www.google.com-conn2-origin-373da1-events-betaservice.testing-oedgetest-z.real-swag-tester.114.oppopay.comtest | Not in the scope | 2026-11-14 |
| www.google.com.foreign-w3.internalsapplication.12-testing.oppopay.comtest | Not in the scope | 2026-11-14 |
| www.google.com-conn2-partypledge-373da1staging.testing-oedgetest-z.124-testing.oppopay.comstaging, test | Not in the scope | 2026-11-14 |
| www.google.com-conn2-origin-373da1.productiontesting-administrators-zdefaulting-oedgedefault-z.130.oppopay.com | Not in the scope | 2026-11-14 |
| www.google.com.foreign-w3.internalsapplication.20-testing.oppopay.comtest | Not in the scope | 2026-11-14 |
| www.google.com.bitservice.oppopay.com | Not in the scope | 2026-11-14 |
| www.google.com-conn2-origin-backendget.raw-oedgeserver.swag-serverer.com-cloudapp.oppopay.com | Not in the scope | 2026-11-14 |
| www.google.com-conn2-infos-tester.oppopay.com | Not in the scope | 2026-11-14 |
| www.google.com.my-storetesting.oppopay.com | Not in the scope | 2026-11-14 |
| www.google.com.foreign-w3.internalsapplication.oedgetest.oppopay.com | Not in the scope | 2026-11-14 |
| www.google.com-conn2-origin-373da1.testing-oedgetest.emea-fw.old.oppopay.comlegacy, test | Not in the scope | 2026-11-14 |
| www.google.com-mgmt.page-oauthtest.oppopay.com | Not in the scope | 2026-11-14 |
| pay.oppopay.com | Not in the scope | 2026-11-14 |
| www.google.com-conn2-origin-373da1.apac-oedgetest-z.real-swag-tester.oppopay.com | Not in the scope | 2026-11-14 |
| seitsm.oppopay.com | Not in the scope | 2026-11-14 |
| www.google.com-conn2-origin-373da1.testing-oedgetest-z.swag-tester.oppopay.comtest | Not in the scope | 2026-11-14 |
| www.google.com-conn2-origin-373da1-jinx.testing-oedgetest.swag-tester.oppopay.comtest | Not in the scope | 2026-11-14 |
| www.google.com-conn2-origin-373da1.testing-oedgetest.swag-tester.oppopay.comtest | Not in the scope | 2026-11-14 |
| www.google.com-conn2-origin-373da1.testing-oshoptest-z.swag-testerdriving-mobile.oppopay.comtest | Not in the scope | 2026-11-14 |
| www.google.com-conn2-origin-373da1.testing-oedgetest-z.bitbucket.swag-testing.oppopay.comgit, test | Not in the scope | 2026-11-14 |
| www.google.com-conn2-internals-373da1.testing.oppopay.comtest | Not in the scope | 2026-11-14 |
| www.google.com.testing.oppopay.comtest | Not in the scope | 2026-11-14 |
| www.google.com.network.demo-ifrus-eu-datafrontpage.foreign.testing.oppopay.comtest | Not in the scope | 2026-11-14 |
| www.google.com-testingreset-staging.foreign-w3.internalsapplication.testing.oppopay.comstaging, test | Not in the scope | 2026-11-14 |
| www.google.com.foreign-w3.internalsapplication.testing.oppopay.comtest | Not in the scope | 2026-11-14 |
| www.google.com.testingistorein.oppopay.com | Not in the scope | 2026-11-14 |
| www.google.com-cloudapp.k8s-backend.testingreset-merchant-backend.testingreset-merchant-backend-documentation.oppopay.comtools | Not in the scope | 2026-11-14 |
| www.google.com-cloudapp.foreign-backend.testingreset-staging.oppopay.comstaging | Not in the scope | 2026-11-14 |
| www.oppopay.com | Not in the scope | 2026-11-14 |
16 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.