Bug bounty program
SN
Snapchat
Most upvoted reports37
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Exposed Kubernetes API - RCE/Exposed CredsAnalysed#455645 | Command and Code Injection | 2021-07-29 | $25,000 | 1,191 |
| Improper Authentication - any user can login as other user with otp/logout & otp/loginAnalysed#921780 | Authentication | 2021-09-03 | – | 972 |
| Delete anyone's content spotlight remotely.Analysed#1819832 | Insecure Direct Object Reference | 2023-03-06 | $15,000 | 801 |
| Github Token Leaked publicly for https://github.sc-corp.netAnalysed#396467 | Cryptography | 2018-10-08 | – | 582 |
| Publicly accessible Continuous Integration ToolAnalysed#313457 | Access Control | 2021-07-29 | – | 562 |
| Access to multiple production Grafana dashboardsAnalysed#663628 | Information Disclosure | 2020-11-04 | $10,000 | 464 |
| Open prod Jenkins instanceAnalysed#231460 | Information Disclosure | 2017-08-19 | $15,000 | 436 |
| Server-Side Request Forgery using Javascript allows to exfill data from Google MetadataAnalysed#530974 | Server-Side Request Forgery | 2020-11-30 | – | 421 |
| Stealing SSO Login Tokens (snappublisher.snapchat.com)Analysed#265943 | Authentication | 2021-07-29 | $7,500 | 244 |
| Leaked JFrog Artifactory username and password exposed on GitHub - https://snapchat.jfrog.ioAnalysed#911606 | Information Disclosure | 2021-08-12 | $15,000 | 137 |
Subdomains1,681
| Name | Scope | First seen |
|---|---|---|
| avatar-api.bitstrips.comapi | Not in the scope | 2026-11-14 |
17 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.