Bug bounty program
OP
OPPO
Most upvoted reports4
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Arbitrary thread deletion on c.realme.com#869705 | Insecure Direct Object Reference | – | $600 | 73 |
| Information Disclosure at https://portal.finzfin.com/1.txt#1011073 | Information Disclosure | – | $50 | 20 |
| No rate limit on Reporting a Threat on [https://community.coloros.com] lead to Increase in the User Group/Points#887684 | Input Validation and Logic | – | $100 | 14 |
| RXSS in https://store.oppomobile.com/#869870 | Cross-site Scripting | – | $100 | 10 |
Subdomains3,641
| Name | Scope | First seen |
|---|---|---|
| flash.realme.net | Not in the scope | 2026-11-14 |
| g-sso.realme.netauth | Not in the scope | 2026-11-14 |
| traffic-lswebext.flgkhjyitqmnluotuxiu.prd.gitlab-pages.realme.netgit | Not in the scope | 2026-11-14 |
| lswebext.region-flgkhjyitqmnluotuxiu.prd.gitlab-pages.realme.netgit | Not in the scope | 2026-11-14 |
| image01.realme.net | Not in the scope | 2026-11-14 |
| image02.realme.net | Not in the scope | 2026-11-14 |
| image03.realme.net | Not in the scope | 2026-11-14 |
| image05.realme.net | Not in the scope | 2026-11-14 |
| o1.realme.net | Not in the scope | 2026-11-14 |
| oms.realme.net | Not in the scope | 2026-11-14 |
| oms-api.realme.netapi | Not in the scope | 2026-11-14 |
| oms-partner-cname-in.realme.net | Not in the scope | 2026-11-14 |
| partner.realme.net | Not in the scope | 2026-11-14 |
| oms.partner.realme.net | Not in the scope | 2026-11-14 |
| pre-oms.partner.realme.net | Not in the scope | 2026-11-14 |
| r.partner.realme.net | Not in the scope | 2026-11-14 |
| r-api.partner.realme.netapi | Not in the scope | 2026-11-14 |
| pre.realme.net | Not in the scope | 2026-11-14 |
| pre-oms.realme.net | Not in the scope | 2026-11-14 |
| pre-oms-api.realme.netapi | Not in the scope | 2026-11-14 |
| prod-render.realme.net | Not in the scope | 2026-11-14 |
| r-partner-api-cname-in.realme.netapi | Not in the scope | 2026-11-14 |
| r-partner-cname-in.realme.net | Not in the scope | 2026-11-14 |
| r1.realme.net | Not in the scope | 2026-11-14 |
| r11.realme.net | Not in the scope | 2026-11-14 |
| r2.realme.net | Not in the scope | 2026-11-14 |
| rms01.realme.net | Not in the scope | 2026-11-14 |
| rms11.realme.net | Not in the scope | 2026-11-14 |
| s1.realme.net | Not in the scope | 2026-11-14 |
| sso.realme.netauth | Not in the scope | 2026-11-14 |
| static.realme.net | Not in the scope | 2026-11-14 |
| static02.realme.net | Not in the scope | 2026-11-14 |
| test1-event.realme.nettest | Not in the scope | 2026-11-14 |
| v2.realme.net | Not in the scope | 2026-11-14 |
| www.realme.net | Not in the scope | 2026-11-14 |
16 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.