Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
27
Disclosed reports
72
Subdomains
23,159
Vendor on CyberSIXT
Reddit (1 CVE, 0 exploited)

Most upvoted reports72

All reports
Most upvoted reports of Reddit
ReportWeaknessDisclosedBountyVotes
One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.comAnalysed#1567186Access Control2022-08-02–509
[accounts.reddit.com] Redirect parameter allows for XSSAnalysed#1962645Cross-site Scripting2023-05-18$5,000394
Blind SSRF to internal services in matrix preview_link APIAnalysed#1960765Server-Side Request Forgery2023-04-26$6,000344
Exposed proxy allows to access internal reddit domainsAnalysed#2967634Access Control2025-02-24$7,500296
RichText parser vulnerability in scheduled posts allows XSSAnalysed#1930763Cross-site Scripting2023-04-20$5,000280
Deleting all DMs on RedditGifts.comAnalysed#1213237Insecure Direct Object Reference2021-10-21$5,000267
Infromation Disclosure To Use of Hard-coded Cryptographic Key#2353237Cryptography2024-02-06–238
XSS via Mod Log Removed PostsAnalysed#1504410Cross-site Scripting2022-03-10–218
IDOR allows an attacker to modify the links of any userAnalysed#1661113Insecure Direct Object Reference2022-09-30–208
Able to bypass email verification and change email to any other user emailAnalysed#1551176Access Control2022-05-06$5,000200

Subdomains23,159

Subdomains of Reddit
NameScopeFirst seen
courrier.reddit.comIn scope2026-11-14
course.reddit.comIn scope2026-11-14
courses.reddit.comIn scope2026-11-14
cover.reddit.comIn scope2026-11-14
covers.reddit.comIn scope2026-11-14
covid-19.reddit.comIn scope2026-11-14
covid19.reddit.comIn scope2026-11-14
covid19-2018.reddit.comIn scope2026-11-14
covid19-dns1.reddit.comIn scope2026-11-14
covid19-dns2.reddit.comIn scope2026-11-14
covid19-im-nm.reddit.comIn scope2026-11-14
covid19-mailin2.reddit.comIn scope2026-11-14
covid19-mx.reddit.commailIn scope2026-11-14
covid19-mx0.reddit.comIn scope2026-11-14
covid19-mx01.reddit.comIn scope2026-11-14
covid19-ns3.reddit.comIn scope2026-11-14
covid19-old.reddit.comlegacyIn scope2026-11-14
covid19-portal.reddit.comIn scope2026-11-14
covid19-www1.reddit.comIn scope2026-11-14
api-docs.covid19.reddit.comapiIn scope2026-11-14
dev.covid19.reddit.comdevIn scope2026-11-14
dns1.covid19.reddit.comIn scope2026-11-14
hazbinhotel.covid19.reddit.comIn scope2026-11-14
mail.covid19.reddit.commailIn scope2026-11-14
mail1.covid19.reddit.commailIn scope2026-11-14
redditama.covid19.reddit.comIn scope2026-11-14
shop.covid19.reddit.comIn scope2026-11-14
smtp.covid19.reddit.commailIn scope2026-11-14
covid191017.reddit.comIn scope2026-11-14
covid19asonmacker.reddit.comIn scope2026-11-14
covid19fout.reddit.comIn scope2026-11-14
covid19il.reddit.comIn scope2026-11-14
covid19imaginaryastronauts.reddit.comIn scope2026-11-14
covid19ipofmytongue.reddit.comIn scope2026-11-14
covid19mail2.reddit.commailIn scope2026-11-14
covid19ns1.reddit.comIn scope2026-11-14
covid19ns2.reddit.comIn scope2026-11-14
covid19remote.reddit.comvpnIn scope2026-11-14
covid19test.reddit.comtestIn scope2026-11-14
covid19webmail.reddit.commailIn scope2026-11-14
covid19www.reddit.comIn scope2026-11-14
covidexm.reddit.comIn scope2026-11-14
cow.reddit.comIn scope2026-11-14
cowboy.reddit.comIn scope2026-11-14
cowboys.reddit.comIn scope2026-11-14
cox.reddit.comIn scope2026-11-14
coyote.reddit.comIn scope2026-11-14
coyotes.reddit.comIn scope2026-11-14
cp.reddit.comIn scope2026-11-14
builder.cp.reddit.comIn scope2026-11-14
ftp.cp.reddit.comdataIn scope2026-11-14
webmail.cp.reddit.commailIn scope2026-11-14
www.cp.reddit.comIn scope2026-11-14
cp01.reddit.comIn scope2026-11-14
cp01int.reddit.comIn scope2026-11-14
cp1.reddit.comIn scope2026-11-14
cp2.reddit.comIn scope2026-11-14
cp3.reddit.comIn scope2026-11-14
cp4.reddit.comIn scope2026-11-14
cp5.reddit.comIn scope2026-11-14
cpa.reddit.comIn scope2026-11-14
cpan.reddit.comIn scope2026-11-14
cpanel.reddit.comadminIn scope2026-11-14
builder.cpanel.reddit.comadminIn scope2026-11-14
webmail.cpanel.reddit.comadmin, mailIn scope2026-11-14
www.cpanel.reddit.comadminIn scope2026-11-14
cpanel1.reddit.comadminIn scope2026-11-14
cpanel2.reddit.comadminIn scope2026-11-14
cpanel3.reddit.comadminIn scope2026-11-14
cpc.reddit.comIn scope2026-11-14
cpd.reddit.comIn scope2026-11-14
cpe.reddit.comIn scope2026-11-14
cpl.reddit.comIn scope2026-11-14
cploginky.reddit.comIn scope2026-11-14
cploginoh.reddit.comIn scope2026-11-14
cpm.reddit.comIn scope2026-11-14
cpn.reddit.comIn scope2026-11-14
cpnew.reddit.comIn scope2026-11-14
cpp.reddit.comIn scope2026-11-14
cps.reddit.comIn scope2026-11-14
www.cps.reddit.comIn scope2026-11-14
cpt.reddit.comIn scope2026-11-14
cptest.reddit.comIn scope2026-11-14
cpw.reddit.comIn scope2026-11-14
cq.reddit.comIn scope2026-11-14
cr.reddit.comIn scope2026-11-14
cr10.reddit.comIn scope2026-11-14
cra.reddit.comIn scope2026-11-14
cracker.reddit.comIn scope2026-11-14
craft.reddit.comIn scope2026-11-14
crafts.reddit.comIn scope2026-11-14
craig.reddit.comIn scope2026-11-14
craiova.reddit.comIn scope2026-11-14
crane.reddit.comIn scope2026-11-14
crash.reddit.comIn scope2026-11-14
crashcourse.reddit.comIn scope2026-11-14
crater.reddit.comIn scope2026-11-14
crawl.reddit.comIn scope2026-11-14
crawler.reddit.comIn scope2026-11-14
crayon.reddit.comIn scope2026-11-14

23,064 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.