Bug bounty program
SN
Snapchat
Most upvoted reports37
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Exposed Kubernetes API - RCE/Exposed CredsAnalysed#455645 | Command and Code Injection | 2021-07-29 | $25,000 | 1,191 |
| Improper Authentication - any user can login as other user with otp/logout & otp/loginAnalysed#921780 | Authentication | 2021-09-03 | – | 972 |
| Delete anyone's content spotlight remotely.Analysed#1819832 | Insecure Direct Object Reference | 2023-03-06 | $15,000 | 801 |
| Github Token Leaked publicly for https://github.sc-corp.netAnalysed#396467 | Cryptography | 2018-10-08 | – | 582 |
| Publicly accessible Continuous Integration ToolAnalysed#313457 | Access Control | 2021-07-29 | – | 562 |
| Access to multiple production Grafana dashboardsAnalysed#663628 | Information Disclosure | 2020-11-04 | $10,000 | 464 |
| Open prod Jenkins instanceAnalysed#231460 | Information Disclosure | 2017-08-19 | $15,000 | 436 |
| Server-Side Request Forgery using Javascript allows to exfill data from Google MetadataAnalysed#530974 | Server-Side Request Forgery | 2020-11-30 | – | 421 |
| Stealing SSO Login Tokens (snappublisher.snapchat.com)Analysed#265943 | Authentication | 2021-07-29 | $7,500 | 244 |
| Leaked JFrog Artifactory username and password exposed on GitHub - https://snapchat.jfrog.ioAnalysed#911606 | Information Disclosure | 2021-08-12 | $15,000 | 137 |
Subdomains1,681
| Name | Scope | First seen |
|---|---|---|
| test.snapchat.comtest | Not in the scope | 2026-11-14 |
| g2-test.snapchat.comtest | Not in the scope | 2026-11-14 |
| prodsec-test.snapchat.comtest | Not in the scope | 2026-11-14 |
| uat.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| demo.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| perception-sandbox.snapchat.comtest | Not in the scope | 2026-11-14 |
| test.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| gws-qa.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| gws-uat.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| cim-api-qa.snappublisher.snapchat.comapi, test | Not in the scope | 2026-11-14 |
| akamai-test.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| cim-api-uat.snappublisher.snapchat.comapi, test | Not in the scope | 2026-11-14 |
| us-east1-aws-acc-test.api.snapchat.comapi, test | Not in the scope | 2026-11-14 |
| us-east1-aws-nlb-test.api.snapchat.comapi, test | Not in the scope | 2026-11-14 |
| perception-sandbox-staging.snapchat.comstaging, test | Not in the scope | 2026-11-14 |
| antivirus.uat.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| cim-api-uat-v.snappublisher.snapchat.comapi, test | Not in the scope | 2026-11-14 |
| uat-antivirus.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| antivirus-demo.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| demo-antivirus.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| demo.antivirus.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| gws-api-sandbox.snappublisher.snapchat.comapi, test | Not in the scope | 2026-11-14 |
| searchportal-qa.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| antivirus-testing.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| testing-antivirus.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| us-east4-gcp-rerouting-test.api.snapchat.comapi, test | Not in the scope | 2026-11-14 |
| akamai-test-origin.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| antivirus-testing1.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| canvas-cim-api-uat.snappublisher.snapchat.comapi, test | Not in the scope | 2026-11-14 |
| cim-data-quality-qa.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| gcom-product-find-qa.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| shop.searchportal-qa.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| chat-gateway097-prod-gws-qa.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| gws-rds-external-readonly-uat.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| antivirusakamai-test-origin.feb.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| antivirus-us-west-1-searchportal-qa.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| gantivirus-aom-produantivirus-at-find-devgws-uat.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| chat-gateway196-prod-gws-rds-external-readonly-uat.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
17 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.