Bug bounty program
OP
OPPO
Most upvoted reports4
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Arbitrary thread deletion on c.realme.com#869705 | Insecure Direct Object Reference | – | $600 | 73 |
| Information Disclosure at https://portal.finzfin.com/1.txt#1011073 | Information Disclosure | – | $50 | 20 |
| No rate limit on Reporting a Threat on [https://community.coloros.com] lead to Increase in the User Group/Points#887684 | Input Validation and Logic | – | $100 | 14 |
| RXSS in https://store.oppomobile.com/#869870 | Cross-site Scripting | – | $100 | 10 |
Subdomains3,641
| Name | Scope | First seen |
|---|---|---|
| staging.wire.community.distribuidorinzfin.ocard-gray.com.finzfin.comstaging | Not in the scope | 2026-11-14 |
| staging.wire.community.distribuidorinzfin.events-ocard-gray.com.finzfin.comstaging | Not in the scope | 2026-11-14 |
| staging.wire.community.distribuidorinzfin.ocard-gray.com-origin.finzfin.comstaging | Not in the scope | 2026-11-14 |
| www.google.com-94e3ff-soloop-img-soloop-img-stg-engine.heytapdownload.comstaging | Not in the scope | 2026-11-14 |
| www.google.com-94e3ff-google-google-preview-cdn-rpc-dev.assets.restricted-prd.activity.heytapdownload.comapi, dev, staging | Not in the scope | 2026-11-14 |
| www.google.com-94e2ff-google-google-content-cdn-file-alpha.91e3ff-assets.restricted-prd.heytapdownload.comstaging | Not in the scope | 2026-11-14 |
| www.google.com-94e3ff-google-google-honors-engine.accounting.assets-origin.alpha.2019-ctl.heytapdownload.comstaging | Not in the scope | 2026-11-14 |
| stg-data.ads.heytapmobi.comstaging | Not in the scope | 2026-11-14 |
| stg-data-f.ads.heytapmobi.comstaging | Not in the scope | 2026-11-14 |
| stg-data-id.ads.heytapmobi.comstaging | Not in the scope | 2026-11-14 |
| stg-data-in.ads.heytapmobi.comstaging | Not in the scope | 2026-11-14 |
| stg-data-sg.ads.heytapmobi.comstaging | Not in the scope | 2026-11-14 |
| stg-data-f.ads.heytapmobile.comstaging | Not in the scope | 2026-11-14 |
| stg-data-id.ads.heytapmobile.comstaging | Not in the scope | 2026-11-14 |
| stg-data-in.ads.heytapmobile.comstaging | Not in the scope | 2026-11-14 |
| stg-data-kh.ads.heytapmobile.comstaging | Not in the scope | 2026-11-14 |
| stg-data-mm.ads.heytapmobile.comstaging | Not in the scope | 2026-11-14 |
| stg-data-my.ads.heytapmobile.comstaging | Not in the scope | 2026-11-14 |
| stg-data-ph.ads.heytapmobile.comstaging | Not in the scope | 2026-11-14 |
| stg-data-sg.ads.heytapmobile.comstaging | Not in the scope | 2026-11-14 |
| stg-data-th.ads.heytapmobile.comstaging | Not in the scope | 2026-11-14 |
| stg-data-tw.ads.heytapmobile.comstaging | Not in the scope | 2026-11-14 |
| stg-data-vn.ads.heytapmobile.comstaging | Not in the scope | 2026-11-14 |
| beta.oppo.cnstaging | Not in the scope | 2026-11-14 |
| stg-image.oppo.comstaging | Not in the scope | 2026-11-14 |
| idcoppofind.domaincontroller.com-stage1.oppofind.comstaging | Not in the scope | 2026-11-14 |
| rulegodosoft-022facebookapp-xsrvjpinsys-staging.app.joyoppofind.0.oppofind.comstaging | Not in the scope | 2026-11-14 |
| clipper.r0.rulegodosoft-022facebookapp-xsrvjpinsys-staging.app-joy.oppofind.comstaging | Not in the scope | 2026-11-14 |
| bvrus15e0shm5fmab4p0.r0.rulehooligan-oppofind.com.chronograf-preview.dc.oppofind.comstaging | Not in the scope | 2026-11-14 |
| bvs89j7gk4m1q2mpe0hg.r0.rulegodosoft-022facebookapp-xsrvjpinsys-staging.app-wwwns.m.oppofind.comstaging | Not in the scope | 2026-11-14 |
| bvs89j7gk4m1q2mpeasg.r0.rulegodosoft-022facebookapp-xsrvjpinsys-staging.app-wwwns.m.oppofind.comstaging | Not in the scope | 2026-11-14 |
| bvs89j7gk4m1q2mpedog.r0.rulegodosoft-022facebookapp-xsrvjpinsys-staging.app-wwwns.m.oppofind.comstaging | Not in the scope | 2026-11-14 |
| bvrv25fagi6fgudvdjgg.r0.rulegodosoft-022facebookapp-xsrvjpinsys-staging.app.joyoppofind.0.oppofind.comstaging | Not in the scope | 2026-11-14 |
| www.google.com-cloudapp.foreign-backend.testingreset-staging.oppopay.comstaging | Not in the scope | 2026-11-14 |
| www.google.com-testingreset-staging.foreign-w3.internalsapplication.testing.oppopay.comstaging, test | Not in the scope | 2026-11-14 |
| www.google.com-conn2-partypledge-373da1staging.testing-oedgetest-z.124-testing.oppopay.comstaging, test | Not in the scope | 2026-11-14 |
| www.google.com-smart-control-panel-digital-apidocssystem-host-applications.staging.global-emailorigin.realmebbs.comadmin, staging | Not in the scope | 2026-11-14 |
| beta5.authentication-gy.bo-facebook.webproxy.idc.bucket.mailtraffichelp.m.realmemobile.comdata, staging | Not in the scope | 2026-11-14 |
| beta5.authentication-gy.bo-facebook.webproxy.idc.bucket.i.mailtraffichelp.m.realmemobile.comdata, staging | Not in the scope | 2026-11-14 |
| beta5.authentication-gy.bo-facebook.webproxy.idc.bucket.mailtraffichelptraffic.m.realmemobile.comdata, staging | Not in the scope | 2026-11-14 |
| beta5.authentication-gy.bo-facebook.profiles.webproxy.idc.bucket.mailtraffichelp.m.realmemobile.comdata, staging | Not in the scope | 2026-11-14 |
| beta5core.authentication-gypay.bo-facebook.webproxy.idc.bucket.mailtraffichelp.m-chd.realmemobile.comdata, staging | Not in the scope | 2026-11-14 |
| beta5.authentication-gy-omsector.bo-facebook.webproxy.idc.bucket.mailtraffichelp.m-chd.realmemobile.comdata, staging | Not in the scope | 2026-11-14 |
| 03alpha.info.realmepaysa.comstaging | Not in the scope | 2026-11-14 |
| 00preprod.info.realmepaysa.comstaging | Not in the scope | 2026-11-14 |
| 00-preprod.info.realmepaysa.comstaging | Not in the scope | 2026-11-14 |
| occ-0-1751-1009.stage1.1.info.realmepaysa.comstaging | Not in the scope | 2026-11-14 |
| jkut123est.stg.develop.14-mail.info.realmepaysa.comdev, mail, staging | Not in the scope | 2026-11-14 |
| beta-simplepictureedit.dl.tb.13.info.realmepaysa.comstaging | Not in the scope | 2026-11-14 |
16 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.