Skip to content
Sign in

Bug bounty program

RE

Reddit

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
27
Disclosed reports
72
Subdomains
23,159

Most upvoted reports72

All reports
Most upvoted reports of Reddit
ReportWeaknessDisclosedBountyVotes
One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.comAnalysed#1567186Access Control2022-08-02–509
[accounts.reddit.com] Redirect parameter allows for XSSAnalysed#1962645Cross-site Scripting2023-05-18$5,000394
Blind SSRF to internal services in matrix preview_link APIAnalysed#1960765Server-Side Request Forgery2023-04-26$6,000344
Exposed proxy allows to access internal reddit domainsAnalysed#2967634Access Control2025-02-24$7,500296
RichText parser vulnerability in scheduled posts allows XSSAnalysed#1930763Cross-site Scripting2023-04-20$5,000280
Deleting all DMs on RedditGifts.comAnalysed#1213237Insecure Direct Object Reference2021-10-21$5,000267
Infromation Disclosure To Use of Hard-coded Cryptographic Key#2353237Cryptography2024-02-06–238
XSS via Mod Log Removed PostsAnalysed#1504410Cross-site Scripting2022-03-10–218
IDOR allows an attacker to modify the links of any userAnalysed#1661113Insecure Direct Object Reference2022-09-30–208
Able to bypass email verification and change email to any other user emailAnalysed#1551176Access Control2022-05-06$5,000200

Subdomains23,159

Root:redditblog.com
Scope
Name suggests
First seen
Text fileClear filters2 names
Subdomains of Reddit
NameScopeFirst seen
np.redditblog.comIn scope2026-11-14
www.redditblog.comIn scope2026-11-14

23,064 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in