Bug bounty program · HackerOne
Most upvoted reports72
- #1567186ValidAnalysedOne-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.comReddit · Access Control · 2022 · needs: no account · OAuth state or flow flaw, OAuth redirect_uri abuse, Account takeover chain–509votes
- #1962645ValidAnalysed[accounts.reddit.com] Redirect parameter allows for XSSReddit · Cross-site Scripting · 2023 · needs: no account · Reflected XSS, Open redirect$5,000394votes
- #1960765ValidAnalysedBlind SSRF to internal services in matrix preview_link APIReddit · Server-Side Request Forgery · 2023 · needs: no account · SSRF, SSRF through a redirect, Information disclosure$6,000344votes
- #2967634ValidAnalysedExposed proxy allows to access internal reddit domainsReddit · Access Control · 2025 · High · needs: no account · SSRF, Missing authorisation check$7,500296votes
- #1930763ValidRichText parser vulnerability in scheduled posts allows XSSReddit · Cross-site Scripting · 2023$5,000280votes
- #1213237ValidDeleting all DMs on RedditGifts.comReddit · Insecure Direct Object Reference · 2021$5,000267votes
- #2353237DuplicateInfromation Disclosure To Use of Hard-coded Cryptographic KeyReddit · Cryptography · 2024–238votes
- #1504410ValidXSS via Mod Log Removed PostsReddit · Cross-site Scripting · 2022–218votes
- #1661113ValidIDOR allows an attacker to modify the links of any userReddit · Insecure Direct Object Reference · 2022–208votes
- #1551176ValidAble to bypass email verification and change email to any other user emailReddit · Access Control · 2022$5,000200votes
Subdomains23,159
23,064 covered by the program's own scope · 0 first seen this week
Roots:reddit.com 22,383 · 22,383 in scopesnooguts.net 457 · 457 in scoperedditmedia.com 195 · 195 in scopedubsmash.com 41redditgifts.com 24redd.it 21redditinc.com 15 · 15 in scopereddithelp.com 12 · 12 in scoperedditstatic.com 6reddituploads.com 3redditblog.com 2 · 2 in scope
Name suggestsAnything
23,159 names
| Name | Scope | First seen |
|---|---|---|
| api.dubsmash.comapi | Not in the scope | 2026-11-14 |
| api-dbsmsh.dubsmash.comapi | Not in the scope | 2026-11-14 |
| api-internal.dubsmash.comapi, internal | Not in the scope | 2026-11-14 |
| blog.dubsmash.com | Not in the scope | 2026-11-14 |
| build.dubsmash.comci | Not in the scope | 2026-11-14 |
| cut.dubsmash.com | Not in the scope | 2026-11-14 |
| dl.dubsmash.com | Not in the scope | 2026-11-14 |
| engineering.dubsmash.com | Not in the scope | 2026-11-14 |
| www.engineering.dubsmash.com | Not in the scope | 2026-11-14 |
| experiments.dubsmash.com | Not in the scope | 2026-11-14 |
| gateway-production.dubsmash.com | Not in the scope | 2026-11-14 |
| get.dubsmash.com | Not in the scope | 2026-11-14 |
| graph.dubsmash.com | Not in the scope | 2026-11-14 |
| indeximport.dubsmash.com | Not in the scope | 2026-11-14 |
| install.dubsmash.com | Not in the scope | 2026-11-14 |
| live.dubsmash.com | Not in the scope | 2026-11-14 |
| messages.dubsmash.com | Not in the scope | 2026-11-14 |
| mg.dubsmash.com | Not in the scope | 2026-11-14 |
| do159-18.mg.dubsmash.com | Not in the scope | 2026-11-14 |
| email.mg.dubsmash.com | Not in the scope | 2026-11-14 |
| mail.mg.dubsmash.commail | Not in the scope | 2026-11-14 |
| a1.mail.mg.dubsmash.commail | Not in the scope | 2026-11-14 |
| a2.mail.mg.dubsmash.commail | Not in the scope | 2026-11-14 |
| o1.sg.news.dubsmash.com | Not in the scope | 2026-11-14 |
| o2.sg.news.dubsmash.com | Not in the scope | 2026-11-14 |
| o3.sg.news.dubsmash.com | Not in the scope | 2026-11-14 |
| profile-internal.dubsmash.cominternal | Not in the scope | 2026-11-14 |
| quotes.dubsmash.com | Not in the scope | 2026-11-14 |
| sandkasten.dubsmash.com | Not in the scope | 2026-11-14 |
| search.dubsmash.com | Not in the scope | 2026-11-14 |
| search2.dubsmash.com | Not in the scope | 2026-11-14 |
| search2-staging.dubsmash.comstaging | Not in the scope | 2026-11-14 |
| status.dubsmash.commonitoring | Not in the scope | 2026-11-14 |
| tag.dubsmash.com | Not in the scope | 2026-11-14 |
| techblog.dubsmash.com | Not in the scope | 2026-11-14 |
| upload.dubsmash.comdata | Not in the scope | 2026-11-14 |
| worker1.dubsmash.com | Not in the scope | 2026-11-14 |
| worker1-staging.dubsmash.comstaging | Not in the scope | 2026-11-14 |
| worker2.dubsmash.com | Not in the scope | 2026-11-14 |
| worker3.dubsmash.com | Not in the scope | 2026-11-14 |
| www.dubsmash.com | Not in the scope | 2026-11-14 |
| 2fi.redd.it | Not in the scope | 2026-11-14 |
| book.redd.it | Not in the scope | 2026-11-14 |
| www.focus.deexternal-preview.redd.itstaging | Not in the scope | 2026-11-14 |
| external-i.redd.it | Not in the scope | 2026-11-14 |
| external-preview.redd.itstaging | Not in the scope | 2026-11-14 |
| g.redd.it | Not in the scope | 2026-11-14 |
| i.redd.it | Not in the scope | 2026-11-14 |
| update.cloud.2d585.cdn.bitdefender.netexternal-preview.redd.itstaging | Not in the scope | 2026-11-14 |
| packaged-media.redd.it | Not in the scope | 2026-11-14 |
| preview.redd.itstaging | Not in the scope | 2026-11-14 |
| cf.preview.redd.itstaging | Not in the scope | 2026-11-14 |
| external.preview.redd.itstaging | Not in the scope | 2026-11-14 |
| share.redd.it | Not in the scope | 2026-11-14 |
| u003ei.redd.it | Not in the scope | 2026-11-14 |
| u003ev.redd.it | Not in the scope | 2026-11-14 |
| v.redd.it | Not in the scope | 2026-11-14 |
| cf.v.redd.it | Not in the scope | 2026-11-14 |
| vps.redd.it | Not in the scope | 2026-11-14 |
| watch.redd.it | Not in the scope | 2026-11-14 |
| www.redd.it | Not in the scope | 2026-11-14 |
| external-preview.www.redd.itstaging | Not in the scope | 2026-11-14 |
| 0.reddit.com | In scope | 2026-11-14 |
| 00.reddit.com | In scope | 2026-11-14 |
| 000.reddit.com | In scope | 2026-11-14 |
| 007.reddit.com | In scope | 2026-11-14 |
| 008ff93ba07ebbf.reddit.com | In scope | 2026-11-14 |
| 01.reddit.com | In scope | 2026-11-14 |
| 02.reddit.com | In scope | 2026-11-14 |
| 02-78.reddit.com | In scope | 2026-11-14 |
| 03.reddit.com | In scope | 2026-11-14 |
| 04.reddit.com | In scope | 2026-11-14 |
| 05.reddit.com | In scope | 2026-11-14 |
| 06.reddit.com | In scope | 2026-11-14 |
| 07.reddit.com | In scope | 2026-11-14 |
| 08.reddit.com | In scope | 2026-11-14 |
| 080.reddit.com | In scope | 2026-11-14 |
| mail.080.reddit.commail | In scope | 2026-11-14 |
| 09.reddit.com | In scope | 2026-11-14 |
| 1.reddit.com | In scope | 2026-11-14 |
| www.1.reddit.com | In scope | 2026-11-14 |
| 10.reddit.com | In scope | 2026-11-14 |
| www.10.reddit.com | In scope | 2026-11-14 |
| 100.reddit.com | In scope | 2026-11-14 |
| 1000.reddit.com | In scope | 2026-11-14 |
| 100daysofketo.reddit.com | In scope | 2026-11-14 |
| 101.reddit.com | In scope | 2026-11-14 |
| 1017coronavirus.reddit.com | In scope | 2026-11-14 |
| 1017coronavirusdns3.reddit.com | In scope | 2026-11-14 |
| 1017covid19.reddit.com | In scope | 2026-11-14 |
| 1017covid19-redditx-03.reddit.com | In scope | 2026-11-14 |
| 103.reddit.com | In scope | 2026-11-14 |
| 105.reddit.com | In scope | 2026-11-14 |
| 106.reddit.com | In scope | 2026-11-14 |
| 109.reddit.com | In scope | 2026-11-14 |
| 10.128.159.10alb.reddit.com | In scope | 2026-11-14 |
| 10.128.159.10gateway.reddit.com | In scope | 2026-11-14 |
| 10.128.159.10gql.reddit.comapi | In scope | 2026-11-14 |
| 11.reddit.com | In scope | 2026-11-14 |
| www.11.reddit.com | In scope | 2026-11-14 |
Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. See the subdomains on the Atlas.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.