Bug bounty program
PP
Palantir Public
Most upvoted reports2
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| SQL Injection at https://files.palantir.com/ due to CVE-2021-38159Analysed#1525200 | SQL Injection | 2022-04-05 | – | 121 |
| Github Account Takeover which is used as gradle vcs in "github.com/palantir/gradle-launch-config-plugin"#1525578 | Access Control | 2022-05-05 | – | 21 |
Subdomains9,266
0 names are covered by the program's own scope; 4 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.