Bug bounty program · HackerOne
Most upvoted reports37
- #455645ValidAnalysedExposed Kubernetes API - RCE/Exposed CredsSnapchat · Command and Code Injection · 2021 · needs: no account · Missing authorisation check, OS command injection, Leaked secret or key$25,0001,191votes
- #921780ValidAnalysedImproper Authentication - any user can login as other user with otp/logout & otp/loginSnapchat · Authentication · 2021 · needs: a user account · Authentication bypass, Account takeover chain, IDOR / object reference–972votes
- #1819832ValidAnalysedDelete anyone's content spotlight remotely.Snapchat · Insecure Direct Object Reference · 2023 · needs: a user account · IDOR / object reference, Missing authorisation check$15,000801votes
- #396467ValidAnalysedGithub Token Leaked publicly for https://github.sc-corp.netSnapchat · Cryptography · 2018 · needs: no account · Leaked secret or key–582votes
- #313457ValidAnalysedPublicly accessible Continuous Integration ToolSnapchat · Access Control · 2021 · needs: no account · Missing authorisation check, Information disclosure, Leaked secret or key–562votes
- #663628ValidAnalysedAccess to multiple production Grafana dashboardsSnapchat · Information Disclosure · 2020 · needs: no account · Missing authorisation check, Information disclosure, SQL injection$10,000464votes
- #231460ValidAnalysedOpen prod Jenkins instanceSnapchat · Information Disclosure · 2017 · needs: a user account · Missing authorisation check, Information disclosure, Leaked secret or key, Code injection / eval$15,000436votes
- #530974ValidAnalysedServer-Side Request Forgery using Javascript allows to exfill data from Google MetadataSnapchat · Server-Side Request Forgery · 2020 · needs: a user account · SSRF, SSRF through a redirect, Information disclosure, Leaked secret or key–421votes
- #265943ValidStealing SSO Login Tokens (snappublisher.snapchat.com)Snapchat · Authentication · 2021$7,500244votes
- #911606ValidLeaked JFrog Artifactory username and password exposed on GitHub - https://snapchat.jfrog.ioSnapchat · Information Disclosure · 2021$15,000137votes
Subdomains1,681
17 covered by the program's own scope · 0 first seen this week
Roots:snapchat.com 1,558 · 15 in scopebitstrips.com 66 · 1 in scopebitmoji.com 26 · 1 in scopespectacles.com 23scan.me 8
Name suggestsAnything
1,681 names
| Name | Scope | First seen |
|---|---|---|
| api.bitmoji.comapi | Not in the scope | 2026-11-14 |
| staging.api.bitmoji.comapi, staging | Not in the scope | 2026-11-14 |
| b.bitmoji.com | Not in the scope | 2026-11-14 |
| data39.adlooxtracking.comimages.bitmoji.com | Not in the scope | 2026-11-14 |
| play.google.comimages.bitmoji.com | Not in the scope | 2026-11-14 |
| officecdn.microsoft.comimages.bitmoji.com | Not in the scope | 2026-11-14 |
| connect.bitmoji.com | Not in the scope | 2026-11-14 |
| devbox-api.bitmoji.comapi | Not in the scope | 2026-11-14 |
| www.ar24.frimages.bitmoji.com | Not in the scope | 2026-11-14 |
| get.bitmoji.com | Not in the scope | 2026-11-14 |
| images.bitmoji.com | Not in the scope | 2026-11-14 |
| www.images.bitmoji.com | Not in the scope | 2026-11-14 |
| ios-beta.bitmoji.comstaging | Not in the scope | 2026-11-14 |
| me.bitmoji.com | Not in the scope | 2026-11-14 |
| preview.bitmoji.comstaging | Not in the scope | 2026-11-14 |
| sdk.bitmoji.com | Not in the scope | 2026-11-14 |
| services.bitmoji.com | Not in the scope | 2026-11-14 |
| staging-api.bitmoji.comapi, staging | Not in the scope | 2026-11-14 |
| staging-connect.bitmoji.comstaging | Not in the scope | 2026-11-14 |
| staging-preview.bitmoji.comstaging | Not in the scope | 2026-11-14 |
| api.staging.bitmoji.comapi, staging | Not in the scope | 2026-11-14 |
| star.bitmoji.com | Not in the scope | 2026-11-14 |
| support.bitmoji.com | Not in the scope | 2026-11-14 |
| test.bitmoji.comtest | Not in the scope | 2026-11-14 |
| www.bitmoji.com | In scope | 2026-11-14 |
| www2.bitmoji.com | Not in the scope | 2026-11-14 |
| a.bitstrips.com | Not in the scope | 2026-11-14 |
| admintools.bitstrips.com | Not in the scope | 2026-11-14 |
| assets.bitstrips.com | Not in the scope | 2026-11-14 |
| avatar-api.bitstrips.comapi | Not in the scope | 2026-11-14 |
| bitchat.bitstrips.com | Not in the scope | 2026-11-14 |
| blog.bitstrips.com | Not in the scope | 2026-11-14 |
| bsauth.bitstrips.com | Not in the scope | 2026-11-14 |
| bsdb.bitstrips.com | Not in the scope | 2026-11-14 |
| bsdb-staging.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| cassets.bitstrips.com | Not in the scope | 2026-11-14 |
| cerebellum.bitstrips.com | Not in the scope | 2026-11-14 |
| cerebellum-vpn.bitstrips.comvpn | Not in the scope | 2026-11-14 |
| character-service.bitstrips.com | Not in the scope | 2026-11-14 |
| chars.bitstrips.com | Not in the scope | 2026-11-14 |
| company.bitstrips.com | Not in the scope | 2026-11-14 |
| compose.bitstrips.com | Not in the scope | 2026-11-14 |
| cloudgz-ecs.gravityzone.bitdefender.comrender.bitstrips.com | Not in the scope | 2026-11-14 |
| cortex.bitstrips.com | Not in the scope | 2026-11-14 |
| cstrips.bitstrips.com | Not in the scope | 2026-11-14 |
| dashboard.bitstrips.comadmin | Not in the scope | 2026-11-14 |
| devbox-character-service.bitstrips.com | Not in the scope | 2026-11-14 |
| email.bitstrips.com | Not in the scope | 2026-11-14 |
| o1.email.bitstrips.com | Not in the scope | 2026-11-14 |
| help.bitstrips.com | Not in the scope | 2026-11-14 |
| images.bitstrips.com | Not in the scope | 2026-11-14 |
| imoji.bitstrips.com | Not in the scope | 2026-11-14 |
| jobs.bitstrips.com | Not in the scope | 2026-11-14 |
| logs.bitstrips.commonitoring | Not in the scope | 2026-11-14 |
| metro.bitstrips.com | Not in the scope | 2026-11-14 |
| production-internal.bitstrips.cominternal | Not in the scope | 2026-11-14 |
| provisioning.bitstrips.com | Not in the scope | 2026-11-14 |
| redirector.bitstrips.com | Not in the scope | 2026-11-14 |
| render.bitstrips.com | Not in the scope | 2026-11-14 |
| resources.bitstrips.com | Not in the scope | 2026-11-14 |
| scenes.bitstrips.com | Not in the scope | 2026-11-14 |
| secure.bitstrips.com | Not in the scope | 2026-11-14 |
| www.secure.bitstrips.com | Not in the scope | 2026-11-14 |
| staging.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| staging-admintools.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| staging-character-service.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| staging-company.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| staging-compose.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| staging-cortex.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| staging-internal.bitstrips.cominternal, staging | Not in the scope | 2026-11-14 |
| staging-render.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| staging-vpn.bitstrips.comstaging, vpn | Not in the scope | 2026-11-14 |
| images.staging.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| logs.staging.bitstrips.commonitoring, staging | Not in the scope | 2026-11-14 |
| static.bitstrips.com | Not in the scope | 2026-11-14 |
| static-server.bitstrips.com | Not in the scope | 2026-11-14 |
| stopbullying.bitstrips.com | Not in the scope | 2026-11-14 |
| strips.bitstrips.com | Not in the scope | 2026-11-14 |
| test.bitstrips.comtest | Not in the scope | 2026-11-14 |
| btv-rendering-service.prod.us-east.bitstrips.com | Not in the scope | 2026-11-14 |
| character-rendering-service.prod.us-east.bitstrips.com | Not in the scope | 2026-11-14 |
| rendering-server-testing.prod.us-east.bitstrips.comtest | Not in the scope | 2026-11-14 |
| rendering-service.prod.us-east.bitstrips.com | Not in the scope | 2026-11-14 |
| rendering-service-internal.prod.us-east.bitstrips.cominternal | Not in the scope | 2026-11-14 |
| www.rendering-service.prod.us-east.bitstrips.com | Not in the scope | 2026-11-14 |
| btv-rendering-service.staging.us-east.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| character-rendering-service.staging.us-east.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| rendering-service.staging.us-east.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| www.rendering-service.staging.us-east.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| rendering-service.wip.us-east.bitstrips.com | Not in the scope | 2026-11-14 |
| vpn.bitstrips.comvpn | Not in the scope | 2026-11-14 |
| www.bitstrips.com | In scope | 2026-11-14 |
| assets.scan.me | Not in the scope | 2026-11-14 |
| email-delivery.scan.me | Not in the scope | 2026-11-14 |
| o1.email-delivery.scan.me | Not in the scope | 2026-11-14 |
| engine.scan.me | Not in the scope | 2026-11-14 |
| get.scan.me | Not in the scope | 2026-11-14 |
| images.scan.me | Not in the scope | 2026-11-14 |
| mail.scan.memail | Not in the scope | 2026-11-14 |
| www.scan.me | Not in the scope | 2026-11-14 |
Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. See the subdomains on the Atlas.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.