Bug bounty program
OP
OPPO
Most upvoted reports4
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Arbitrary thread deletion on c.realme.com#869705 | Insecure Direct Object Reference | – | $600 | 73 |
| Information Disclosure at https://portal.finzfin.com/1.txt#1011073 | Information Disclosure | – | $50 | 20 |
| No rate limit on Reporting a Threat on [https://community.coloros.com] lead to Increase in the User Group/Points#887684 | Input Validation and Logic | – | $100 | 14 |
| RXSS in https://store.oppomobile.com/#869870 | Cross-site Scripting | – | $100 | 10 |
Subdomains3,641
| Name | Scope | First seen |
|---|---|---|
| moa-upload-online.coloros.comdata | Not in the scope | 2026-11-14 |
| moa-upload-online-in.coloros.comdata | Not in the scope | 2026-11-14 |
| mysql6.3-dropbox.r0.rule-album-trafficn01a01a.ocloud-test-8-ww1.tool.tadpole-d.ns.e.e.heytap.comdata, test | Not in the scope | 2026-11-14 |
| no.edge.s3.apk.scm.myoppo.comdata, git | Not in the scope | 2026-11-14 |
| bvruut5e0shinubtlru0.edge.s3.apk.scm.myoppo.comdata, git | Not in the scope | 2026-11-14 |
| bvrv22le0shhjvob4e40.elastic.apk.scm.myoppo.comdata, git | Not in the scope | 2026-11-14 |
| bvrv22le0shhjvob598g.elastic.apk.scm.myoppo.comdata, git | Not in the scope | 2026-11-14 |
| ftp.oppo.comdata | Not in the scope | 2026-11-14 |
| rabbitmq.opay.oppoer.medata | Not in the scope | 2026-11-14 |
| netstage.foro.0-database.oppofind.comdata | Not in the scope | 2026-11-14 |
| webrd04.uploads.redirectme.netoppofind.0.oppofind.comdata | Not in the scope | 2026-11-14 |
| bvrvq9jpg8nhi0fn0ol0.webproxy.idcjoy.jobs-bdjobs-com.team.0.joy-com-rctivicejpw6qr-bucket.oppofind.comdata | Not in the scope | 2026-11-14 |
| www.google.com-smart-2-panel-digital-archive-pre-www-applications.global.elastic-cms.realmebbs.comadmin, data, legacy | Not in the scope | 2026-11-14 |
| beta5.authentication-gy.bo-facebook.webproxy.idc.bucket.mailtraffichelp.m.realmemobile.comdata, staging | Not in the scope | 2026-11-14 |
| beta5.authentication-gy.bo-facebook.webproxy.idc.bucket.i.mailtraffichelp.m.realmemobile.comdata, staging | Not in the scope | 2026-11-14 |
| fanclub.authentication-gy.bo-facebook.webproxy.idc.bucket.mailtraffichelp.m.realmemobile.comdata | Not in the scope | 2026-11-14 |
| beta5.authentication-gy.bo-facebook.webproxy.idc.bucket.mailtraffichelptraffic.m.realmemobile.comdata, staging | Not in the scope | 2026-11-14 |
| beta5.authentication-gy.bo-facebook.profiles.webproxy.idc.bucket.mailtraffichelp.m.realmemobile.comdata, staging | Not in the scope | 2026-11-14 |
| beta5core.authentication-gypay.bo-facebook.webproxy.idc.bucket.mailtraffichelp.m-chd.realmemobile.comdata, staging | Not in the scope | 2026-11-14 |
| beta5.authentication-gy-omsector.bo-facebook.webproxy.idc.bucket.mailtraffichelp.m-chd.realmemobile.comdata, staging | Not in the scope | 2026-11-14 |
16 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.