Bug bounty program
PP
Palantir Public
Most upvoted reports2
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| SQL Injection at https://files.palantir.com/ due to CVE-2021-38159Analysed#1525200 | SQL Injection | 2022-04-05 | – | 121 |
| Github Account Takeover which is used as gradle vcs in "github.com/palantir/gradle-launch-config-plugin"Analysed#1525578 | Access Control | 2022-05-05 | – | 21 |
Subdomains9,266
| Name | Scope | First seen |
|---|---|---|
| github.palantir.buildgit | No domain scope published | 2026-11-14 |
| assets.github.palantir.buildgit | No domain scope published | 2026-11-14 |
| avatars.github.palantir.buildgit | No domain scope published | 2026-11-14 |
| codeload.github.palantir.buildgit | No domain scope published | 2026-11-14 |
| gist.github.palantir.buildgit | No domain scope published | 2026-11-14 |
| media.github.palantir.buildgit | No domain scope published | 2026-11-14 |
| pages.github.palantir.buildgit | No domain scope published | 2026-11-14 |
| raw.github.palantir.buildgit | No domain scope published | 2026-11-14 |
| render.github.palantir.buildgit | No domain scope published | 2026-11-14 |
| reply.github.palantir.buildgit | No domain scope published | 2026-11-14 |
| uploads.github.palantir.builddata, git | No domain scope published | 2026-11-14 |
| wildcard.github.palantir.buildgit | No domain scope published | 2026-11-14 |
| github.staging.palantir.buildgit, staging | No domain scope published | 2026-11-14 |
| github-test.staging.palantir.buildgit, staging, test | No domain scope published | 2026-11-14 |
| ci-cache.github.staging.palantir.buildci, git, staging | No domain scope published | 2026-11-14 |
| valis-repo.palantir.comgit | No domain scope published | 2026-11-14 |
| github-internal.washington.palantircloud.comgit, internal | No domain scope published | 2026-11-14 |
| github-sec.washington.palantircloud.comgit | No domain scope published | 2026-11-14 |
| wildcard.github-sec.washington.palantircloud.comgit | No domain scope published | 2026-11-14 |
| github.internal.washington.palantircloud.comgit, internal | No domain scope published | 2026-11-14 |
| github-itar.internal.washington.palantircloud.comgit, internal | No domain scope published | 2026-11-14 |
| github-sec.internal.washington.palantircloud.comgit, internal | No domain scope published | 2026-11-14 |
| repo-bgate.palantirfoundry.comgit | No domain scope published | 2026-11-14 |
| bifrost-gitlab.palantirgov.comgit | No domain scope published | 2026-11-14 |
| gitlab-bifrost.palantirgov.comgit | No domain scope published | 2026-11-14 |
| gitlab-bifrost-tmp.palantirgov.comgit | No domain scope published | 2026-11-14 |
0 names are covered by the program's own scope; 4 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.