Bug bounty program
QU
Quora
Most upvoted reports8
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| XSS through `__e2e_action_id` delivered by JSONPAnalysed#259100 | Cross-site Scripting | 2018-03-08 | – | 53 |
| [Android] XSS via start ContentActivityAnalysed#189793 | Cross-site Scripting | 2017-04-05 | – | 50 |
| [Quora Android] Possible to steal arbitrary files from mobile deviceAnalysed#258460 | Information Disclosure | 2017-08-30 | – | 23 |
| XSS when clicking "Share to Twitter" at quora.com/widgets/embed_iframe?path=...Analysed#258876 | Cross-site Scripting | 2018-01-11 | – | 21 |
| [controlsyou.quora.com] 429 Too Many Requests Error-Page XSSAnalysed#189768 | Cross-site Scripting | 2017-03-31 | – | 20 |
| self xss in#228539 | Cross-site Scripting | 2017-05-22 | – | 7 |
| IDNs displayed in unicode#266454 | Misconfiguration and Insecure Design | 2017-10-25 | – | 6 |
| Possibility of DOS Through logging System#242489 | No weakness recorded | 2017-08-16 | – | 2 |
Subdomains51,611
| Name | Scope | First seen |
|---|---|---|
| qa.fgrealty.app.mobiletest | Not in the scope | 2026-11-14 |
| akamai-test.quora.comtest | In scope | 2026-11-14 |
| akamai-test-origin.quora.comtest | In scope | 2026-11-14 |
| cim-api-qa.quora.comapi, test | In scope | 2026-11-14 |
| cim-api-uat.quora.comapi, test | In scope | 2026-11-14 |
| cim-data-quality-qa.quora.comtest | In scope | 2026-11-14 |
| conversion-optimization-sandbox.quora.comtest | In scope | 2026-11-14 |
| demo.quora.comtest | In scope | 2026-11-14 |
| www-test.alumni.dev.quora.comdev, test | In scope | 2026-11-14 |
| antivirus.www-test.alumni.dev.quora.comdev, test | In scope | 2026-11-14 |
| www.antivirus.www-test.alumni.dev.quora.comdev, test | In scope | 2026-11-14 |
| nwang-test.dev.quora.comdev, test | In scope | 2026-11-14 |
| gcom-product-find-qa.quora.comtest | In scope | 2026-11-14 |
| gws-api-sandbox.quora.comapi, test | In scope | 2026-11-14 |
| gws-qa.quora.comtest | In scope | 2026-11-14 |
| gws-rds-external-readonly-uat.quora.comtest | In scope | 2026-11-14 |
| gws-uat.quora.comtest | In scope | 2026-11-14 |
| nwang-test.main.quora.comtest | In scope | 2026-11-14 |
| nandemo-dare-demo.quora.comtest | In scope | 2026-11-14 |
| offshore-software-development-testing.quora.comdev, test | In scope | 2026-11-14 |
| pass-drug-test.quora.comtest | In scope | 2026-11-14 |
| searchportal-qa.quora.comtest | In scope | 2026-11-14 |
| test.quora.comtest | In scope | 2026-11-14 |
| udt22sbx.quora.comtest | In scope | 2026-11-14 |
51,595 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.