Bug bounty program
OP
OPPO
Most upvoted reports4
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Arbitrary thread deletion on c.realme.com#869705 | Insecure Direct Object Reference | – | $600 | 73 |
| Information Disclosure at https://portal.finzfin.com/1.txt#1011073 | Information Disclosure | – | $50 | 20 |
| No rate limit on Reporting a Threat on [https://community.coloros.com] lead to Increase in the User Group/Points#887684 | Input Validation and Logic | – | $100 | 14 |
| RXSS in https://store.oppomobile.com/#869870 | Cross-site Scripting | – | $100 | 10 |
Subdomains3,641
| Name | Scope | First seen |
|---|---|---|
| www.google.com-search-api-api-honors-enginepanel.heytapdownload.comapi | Not in the scope | 2026-11-14 |
| www.google.com-94e3ff-google-google-content-cdn-rpc-backend.assets.restricted-prd.heytapdownload.comapi | Not in the scope | 2026-11-14 |
| www.google.com-94e3ff-google-google-preview-cdn-rpc-dev.assets.restricted-prd.activity.heytapdownload.comapi, dev, staging | Not in the scope | 2026-11-14 |
| www.google.com-94e3ff-google-google-content-cdn-rpc-qa.assets.restricted-prdcc-open-cdn.heytapdownload.comapi, test | Not in the scope | 2026-11-14 |
| www.google.com-94e3ff-google-google-content-cdn-rpc-local.dashboard.assets.restricted-prd.activity.heytapdownload.comadmin, api, dev | Not in the scope | 2026-11-14 |
| www.google.com-94e3ff-google-google-content-cdn-rpc-qt.assets.restricted-prd.activity.11.heytapimage.comapi | Not in the scope | 2026-11-14 |
| api-uc.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api.ads.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api.ois.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api.jits.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-cn.cdo.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-gl.cdo.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-cn.game.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-cn.open.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-cn.play.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-gl.game.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-id.game.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-in.game.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-my.game.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-ph.game.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-th.game.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-tw.game.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-vn.game.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| opbr-api-cn.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| openapi-slp.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-cn.store.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-cn.theme.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-gl.store.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-gl.theme.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-id.store.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-id.theme.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-in.store.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-in.theme.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-my.store.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-ph.store.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-th.store.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-tw.store.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-vn.store.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-cn.instant.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| infrasec-openapi-cn.heytapmobi.comapi | Not in the scope | 2026-11-14 |
| api-gl.cdo.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-id.cdo.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-in.cdo.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-id.game.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-id.play.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-in.game.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-in.play.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-my.game.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-ph.game.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-ph.play.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-th.game.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-th.play.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-vn.game.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-vn.play.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| jits-api-sg.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-gl.theme.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-id.theme.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-in.theme.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-my.theme.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-ph.theme.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-th.theme.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-tw.theme.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-vn.theme.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| store-api-fr.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| ocloud-api-in.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api-id.instant.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| cloudkit-api-in.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| magazine-api-fr.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| member-openapi-in.heytapmobile.comapi | Not in the scope | 2026-11-14 |
| api.myoas.comapi | Not in the scope | 2026-11-14 |
| dmg-dts-api.myoas.comapi | Not in the scope | 2026-11-14 |
| dev-api.myoas.netapi, dev | Not in the scope | 2026-11-14 |
| oms-api.myoas.netapi | Not in the scope | 2026-11-14 |
| test1-api.myoas.netapi, test | Not in the scope | 2026-11-14 |
| dev-oms-api.myoas.netapi, dev | Not in the scope | 2026-11-14 |
| test1-oms-api.myoas.netapi, test | Not in the scope | 2026-11-14 |
| test2-oms-api.myoas.netapi, test | Not in the scope | 2026-11-14 |
| test-app-api.partner.myoas.netapi, test | Not in the scope | 2026-11-14 |
| www.google.com-swagger.portal-help-proxyadministrator.myoas.netapi | Not in the scope | 2026-11-14 |
| drp-api-in.myoppo.comapi | Not in the scope | 2026-11-14 |
| api-phx-oln.myoppo.comapi | Not in the scope | 2026-11-14 |
| tonight.apk.scm.jinx-2dbc3f05-management.api.myoppo.comadmin, api, git | Not in the scope | 2026-11-14 |
| bvs41nvgk4m5emkb5pu0.2dbc3f05sitory.apk.scm.api.myoppo.comapi, git | Not in the scope | 2026-11-14 |
| bvs84ule0shsdjiih51g.apk.scm.jinx-2dbc3f05-management.api.myoppo.comadmin, api, git | Not in the scope | 2026-11-14 |
| bvs84ule0shsdjiihek0.apk.scm.jinx-2dbc3f05-management.api.myoppo.comadmin, api, git | Not in the scope | 2026-11-14 |
| bvruuhrpg8njqip9istg.repository.apk.scm.jinx-2dbc3f05-management.api.myoppo.comadmin, api, git | Not in the scope | 2026-11-14 |
| bvsbk6ngk4m183mm7b8g.repository.apk.scm.2dbc3f05-managementadministrator.api.myoppo.comapi, git | Not in the scope | 2026-11-14 |
| bvsbk6ngk4m183mm7mig.repository.apk.scm.2dbc3f05-managementadministrator.api.myoppo.comapi, git | Not in the scope | 2026-11-14 |
| i-api.oppo.cnapi | Not in the scope | 2026-11-14 |
| i.api.oppo.cnapi | Not in the scope | 2026-11-14 |
| wx.api.images.oppo.cnapi | Not in the scope | 2026-11-14 |
| api.update2021.oppo.cnapi | Not in the scope | 2026-11-14 |
| opsg-api-in.oppo.comapi | Not in the scope | 2026-11-14 |
| opss-api-sg.oppo.comapi | Not in the scope | 2026-11-14 |
| seebeyond-api.oppo.comapi | Not in the scope | 2026-11-14 |
| oidgeructiontasks-api-docs.0.oppofind.comapi | Not in the scope | 2026-11-14 |
| webservices.redirectme.netoppofind-cba9876543210zyxw.2.1.0.oppofind.comapi | Not in the scope | 2026-11-14 |
| bvrvnunagi6dmvhdco9g.wire.community-swagger.budget.ecppofind.com-rctivice.0earwww0.oppofind.comapi | Not in the scope | 2026-11-14 |
| api.e.oppomobile.comapi | Not in the scope | 2026-11-14 |
| api.uc.oppomobile.comapi | Not in the scope | 2026-11-14 |
16 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.