Bug bounty program
OP
OPPO
Most upvoted reports4
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Arbitrary thread deletion on c.realme.com#869705 | Insecure Direct Object Reference | – | $600 | 73 |
| Information Disclosure at https://portal.finzfin.com/1.txt#1011073 | Information Disclosure | – | $50 | 20 |
| No rate limit on Reporting a Threat on [https://community.coloros.com] lead to Increase in the User Group/Points#887684 | Input Validation and Logic | – | $100 | 14 |
| RXSS in https://store.oppomobile.com/#869870 | Cross-site Scripting | – | $100 | 10 |
Subdomains3,641
| Name | Scope | First seen |
|---|---|---|
| www.google.com-94e3ff-dev-it-dev-it-honors-92e3ff-paywall.heytapdownload.comdev | Not in the scope | 2026-11-14 |
| www.google.com-94e3ff-google-google-preview-cdn-rpc-dev.assets.restricted-prd.activity.heytapdownload.comapi, dev, staging | Not in the scope | 2026-11-14 |
| www.google.com-94e3ff-google-google-content-cdn-rpc-local.dashboard.assets.restricted-prd.activity.heytapdownload.comadmin, api, dev | Not in the scope | 2026-11-14 |
| www.google.com-adsense-firewall-idsmedia6-ocloud-start-make-money-online.edgeappdev2-dev-ed--csfdc-idsmedia6.heytapimage.comdev | Not in the scope | 2026-11-14 |
| dev.game.keke.cndev | Not in the scope | 2026-11-14 |
| dev4-6106.archive.foreign.google.com-cloud-platform-machine-learning-engine.sau.google.com.weather.flow.browser.keke.cndev, legacy | Not in the scope | 2026-11-14 |
| localhost-mtp.myoas.comdev | Not in the scope | 2026-11-14 |
| dev.myoas.netdev | Not in the scope | 2026-11-14 |
| dev-api.myoas.netapi, dev | Not in the scope | 2026-11-14 |
| dev-oms.myoas.netdev | Not in the scope | 2026-11-14 |
| dev-static.myoas.netdev | Not in the scope | 2026-11-14 |
| dev-oms-api.myoas.netapi, dev | Not in the scope | 2026-11-14 |
| www.google.com.academic.dev-pay.myoas.netdev | Not in the scope | 2026-11-14 |
| www.google.com.marshall.dev-pay.myoas.netdev | Not in the scope | 2026-11-14 |
| www.google.com.acc-testvb-asana.dev-pay.myoas.netdev | Not in the scope | 2026-11-14 |
| www.google.com.acc-dev-oms-asana.dev-pay.myoas.netdev | Not in the scope | 2026-11-14 |
| www.google.com.acc-dev-oms-asana.atlantic.myoas.netdev | Not in the scope | 2026-11-14 |
| www.google.com.acc-calendars-asana.dev-pay.myoas.netdev | Not in the scope | 2026-11-14 |
| www.google.com.acc-testvb-asana.dev-payedge.myoas.netdev | Not in the scope | 2026-11-14 |
| www.google.com.acc-formularios-asana.dev-pay.myoas.netdev | Not in the scope | 2026-11-14 |
| dev.gc.nearme.com.cndev | Not in the scope | 2026-11-14 |
| hbpb12zwzicloudfrontgicloudfrontxfw.webproxy.idcservicenow.dev-ai-foreign-redirector.mmagzinefs8.nearme.com.cndev | Not in the scope | 2026-11-14 |
| dev.oms.oppo.comdev | Not in the scope | 2026-11-14 |
| webproxy.idcjoy.jobs-aws-jobs-loadbalancer-comk8s-dev-comyountselegorysistmall.service-merchant-0.europewest.0.oppofind.comdev | Not in the scope | 2026-11-14 |
| dev.theme.oppomobile.comdev | Not in the scope | 2026-11-14 |
| saserver-dev.search.oppomobile.comdev | Not in the scope | 2026-11-14 |
| www.google.com-smart-test-panel-digital-k8s-dev-host-statslications.diadmal.realmebbs.comadmin, dev, test, tools | Not in the scope | 2026-11-14 |
| 1-times-dev.info.realmepaysa.comdev | Not in the scope | 2026-11-14 |
| 11times-dev.info.realmepaysa.comdev | Not in the scope | 2026-11-14 |
| 12-times-dev.info.realmepaysa.comdev | Not in the scope | 2026-11-14 |
| osa.pr.dev.13-mail.info.realmepaysa.comdev, mail | Not in the scope | 2026-11-14 |
| aac0516.my-dev.14-mail.info.realmepaysa.comdev, mail | Not in the scope | 2026-11-14 |
| autocad-cust51.pr.dev.10mail.info.realmepaysa.comdev, mail | Not in the scope | 2026-11-14 |
| autocad-cust51.pr.dev.13mail.info.realmepaysa.comdev, mail | Not in the scope | 2026-11-14 |
| jkut123est.stg.develop.14-mail.info.realmepaysa.comdev, mail, staging | Not in the scope | 2026-11-14 |
| web17748-descargas.pr.dev.11-mail.info.realmepaysa.comdev, mail | Not in the scope | 2026-11-14 |
| cdo-dev.wanyol.comdev | Not in the scope | 2026-11-14 |
| theme-dev.wanyol.comdev | Not in the scope | 2026-11-14 |
| dev.storage.wanyol.comdev | Not in the scope | 2026-11-14 |
| i-dev-search.wanyol.comdev | Not in the scope | 2026-11-14 |
| opsg-dev1www.wanyol.comdev | Not in the scope | 2026-11-14 |
| ms-dev-search.wanyol.comdev | Not in the scope | 2026-11-14 |
| cpc-assets-dev.wanyol.comdev | Not in the scope | 2026-11-14 |
| dfs-server-dev.wanyol.comdev | Not in the scope | 2026-11-14 |
| jits-engine-dev.wanyol.comdev | Not in the scope | 2026-11-14 |
| epoch-dev.pay-test.wanyol.comdev, test | Not in the scope | 2026-11-14 |
| io-qos.dev.storage.wanyol.comdev | Not in the scope | 2026-11-14 |
| ivideo.dev-browser.wanyol.comdev | Not in the scope | 2026-11-14 |
| opsg-dev1statics-gl.wanyol.comdev | Not in the scope | 2026-11-14 |
| gkm-portal-local-pre.wanyol.comdev | Not in the scope | 2026-11-14 |
| theme-dev.store-test.wanyol.comdev, test | Not in the scope | 2026-11-14 |
| dhfs.dev.browserproxy.wanyol.comdev | Not in the scope | 2026-11-14 |
| wealth-fin-dev.pay-test.wanyol.comdev, test | Not in the scope | 2026-11-14 |
16 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.