Bug bounty program
OP
OPPO
Most upvoted reports4
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Arbitrary thread deletion on c.realme.com#869705 | Insecure Direct Object Reference | – | $600 | 73 |
| Information Disclosure at https://portal.finzfin.com/1.txt#1011073 | Information Disclosure | – | $50 | 20 |
| No rate limit on Reporting a Threat on [https://community.coloros.com] lead to Increase in the User Group/Points#887684 | Input Validation and Logic | – | $100 | 14 |
| RXSS in https://store.oppomobile.com/#869870 | Cross-site Scripting | – | $100 | 10 |
Subdomains3,641
| Name | Scope | First seen |
|---|---|---|
| 3ecwgwp-lcnt4.auth.cust78.confjihgfedc.8g.cc.heytapmobi.comauth | Not in the scope | 2026-11-14 |
| auth.phonemail.keke.cnauth | Not in the scope | 2026-11-14 |
| sso.myoas.comauth | Not in the scope | 2026-11-14 |
| adfs.t2mail.myoas.comauth, mail | Not in the scope | 2026-11-14 |
| www.google.com-test1-sso-account-start-make-money-online.iad-comazureproxyassets.test2-cc-testkuberproxyes.myoas.netauth, test | Not in the scope | 2026-11-14 |
| google.com-94e3ff-google-google-honors-musiceu33.assets.train-auth-witchernetflix.backend.global-phpeuropege.myoas.netauth | Not in the scope | 2026-11-14 |
| sso.myoppo.comauth | Not in the scope | 2026-11-14 |
| bvrut2euc7d63bok73sg.auth.2dbc3f05.apk.scm.myoppo.comauth, git | Not in the scope | 2026-11-14 |
| bvrv45rpg8nmft1lb4q0.auth.hwcdn.global.apk.scm.myoppo.comauth, git | Not in the scope | 2026-11-14 |
| sso.basic.oppoer.meauth | Not in the scope | 2026-11-14 |
| i.sso.basic.oppoer.meauth | Not in the scope | 2026-11-14 |
| team.auth.0.oppofind.comauth | Not in the scope | 2026-11-14 |
| bvrvuifgk4mcamq2vh90.webproxy.idcjoy-gist.jobs-bdjobs-com.team.auth.0.oppofind.comauth | Not in the scope | 2026-11-14 |
| bvrvuifgk4mcamq30bp0.webproxy.idcjoy-gist.jobs-bdjobs-com.team.auth.0.oppofind.comauth | Not in the scope | 2026-11-14 |
| sso.realme.netauth | Not in the scope | 2026-11-14 |
| g-sso.realme.netauth | Not in the scope | 2026-11-14 |
| auth.12c.info.realmepaysa.comauth | Not in the scope | 2026-11-14 |
| 12c-login.info.realmepaysa.comauth | Not in the scope | 2026-11-14 |
| occ-0-1751-1009.auth.1.info.realmepaysa.comauth | Not in the scope | 2026-11-14 |
| 0-scifinder.cas.org.12library.info.realmepaysa.comauth | Not in the scope | 2026-11-14 |
| auth.uctest.wanyol.comauth | Not in the scope | 2026-11-14 |
| i2.auth.uctest.wanyol.comauth | Not in the scope | 2026-11-14 |
| oauth.ucnewtest.wanyol.comauth | Not in the scope | 2026-11-14 |
| i.auth.ucnewtest.wanyol.comauth | Not in the scope | 2026-11-14 |
| uc-oauth.ucnewtest.wanyol.comauth | Not in the scope | 2026-11-14 |
16 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.