Bug bounty program
SN
Snapchat
Most upvoted reports37
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Exposed Kubernetes API - RCE/Exposed CredsAnalysed#455645 | Command and Code Injection | 2021-07-29 | $25,000 | 1,191 |
| Improper Authentication - any user can login as other user with otp/logout & otp/loginAnalysed#921780 | Authentication | 2021-09-03 | – | 972 |
| Delete anyone's content spotlight remotely.Analysed#1819832 | Insecure Direct Object Reference | 2023-03-06 | $15,000 | 801 |
| Github Token Leaked publicly for https://github.sc-corp.netAnalysed#396467 | Cryptography | 2018-10-08 | – | 582 |
| Publicly accessible Continuous Integration ToolAnalysed#313457 | Access Control | 2021-07-29 | – | 562 |
| Access to multiple production Grafana dashboardsAnalysed#663628 | Information Disclosure | 2020-11-04 | $10,000 | 464 |
| Open prod Jenkins instanceAnalysed#231460 | Information Disclosure | 2017-08-19 | $15,000 | 436 |
| Server-Side Request Forgery using Javascript allows to exfill data from Google MetadataAnalysed#530974 | Server-Side Request Forgery | 2020-11-30 | – | 421 |
| Stealing SSO Login Tokens (snappublisher.snapchat.com)Analysed#265943 | Authentication | 2021-07-29 | $7,500 | 244 |
| Leaked JFrog Artifactory username and password exposed on GitHub - https://snapchat.jfrog.ioAnalysed#911606 | Information Disclosure | 2021-08-12 | $15,000 | 137 |
Subdomains1,681
| Name | Scope | First seen |
|---|---|---|
| chat-gateway141-prod5.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| antivirus-chef.chat-gateway154-prod.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| chat-gateway155-prod.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| chat-gateway158-prod-wfm-service.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| chat-gateway166-prod-evelynn-antivirus.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| mongodb.chat-gateway169-prod.snappublisher.snapchat.comdata | Not in the scope | 2026-11-14 |
| spf.chat-gateway171-prod.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| chat-gateway174-prod-fw.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| chat-gateway178-prod-stats.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| controlantivirus.chat-gateway181-prod.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| chat-gateway185-prodww1.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| chat-gateway188-prod-smtp.snappublisher.snapchat.commail | Not in the scope | 2026-11-14 |
| chat-gateway194-prod-antivirus-login.snappublisher.snapchat.comauth | Not in the scope | 2026-11-14 |
| chat-gateway196-prod-gws-rds-external-readonly-uat.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| antivirusaccounts.chat-gateway214-prod.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| chat-gateway217-prod-webappantivirus.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| chat-gateway271-prodvideos.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| antivirus.com.chat-gateway273-prod.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| chat-gateway281-prodantivirusanalytics.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| antiviruss3.chat-gateway284-prod.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| chat-gateway296-prod-dev.snappublisher.snapchat.comdev | Not in the scope | 2026-11-14 |
| chat-gateway299-prod-dns1.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| portal.chat-gateway299-prod-dns1.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| 13.chat-gateway330-prod.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| click.chat-gateway341-prod.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| chat-gateway349-prod-help.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| chat-gateway367-prodcfantivirus.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| antivirusaccounts.chat-gateway383-prod-chat-gateway214-prod.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| chat-gateway392-prodml.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| int.chat-gateway398-prodantivirus.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| check.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| ciantivirus.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| ciantivirus-ui.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| cim-api.snappublisher.snapchat.comapi | Not in the scope | 2026-11-14 |
| cim-api-dev.snappublisher.snapchat.comapi, dev | Not in the scope | 2026-11-14 |
| cim-api-qa.snappublisher.snapchat.comapi, test | Not in the scope | 2026-11-14 |
| cim-api-uat.snappublisher.snapchat.comapi, test | Not in the scope | 2026-11-14 |
| cim-api-uat-v.snappublisher.snapchat.comapi, test | Not in the scope | 2026-11-14 |
| cim-data-quality-qa.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| cim-dev.snappublisher.snapchat.comdev | Not in the scope | 2026-11-14 |
| cim-geo-dev.snappublisher.snapchat.comdev | Not in the scope | 2026-11-14 |
| antivirusweb.cisco-uds.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| antivirusweb.chat-gateway233-prod.cisco-uds.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| citrix.snappublisher.snapchat.comvpn | Not in the scope | 2026-11-14 |
| click.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| click-chat-gateway001-stage.snappublisher.snapchat.comstaging | Not in the scope | 2026-11-14 |
| click-gac-rds-external-readonly.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| client.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| antivirus.client.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| cloud.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| cloudfront.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| antivirus.cloudfront.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| cloudfrontantivirus.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| cms1.snappublisher.snapchat.comadmin | Not in the scope | 2026-11-14 |
| antivirus.cms1.snappublisher.snapchat.comadmin | Not in the scope | 2026-11-14 |
| cmsantivirus.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| cmsantivirus-nginx-antivirus.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| cname.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| code.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| chat-gateway247-prod.code.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| cognac-antivirus-poland.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| collab.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| com.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| 0virus-antivirus.com.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| antivirus.com.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| antivirus-antivirus-php.com.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| chat-gateway103-prod.antivirus.com.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| antiviruskorea-antivirus.com.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| confluence.snappublisher.snapchat.comtools | Not in the scope | 2026-11-14 |
| confluence-chat-gateway190-prod.snappublisher.snapchat.comtools | Not in the scope | 2026-11-14 |
| antivirus.confluence.snappublisher.snapchat.comtools | Not in the scope | 2026-11-14 |
| antivirus.confluences.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| consul.snappublisher.snapchat.comtools | Not in the scope | 2026-11-14 |
| container.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| antivirus.container.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| news.container.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| control.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| antivirus.control.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| controlantivirus.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| cp.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| cpanel.snappublisher.snapchat.comadmin | Not in the scope | 2026-11-14 |
| crm.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| cveapi.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| danieapp.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| db.snappublisher.snapchat.comdata | Not in the scope | 2026-11-14 |
| dc.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| de.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| decantivirus.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| dechat-gateway096-prod.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| demo.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| demo-antivirus.snappublisher.snapchat.comtest | Not in the scope | 2026-11-14 |
| dev.snappublisher.snapchat.comdev | Not in the scope | 2026-11-14 |
| antivirus.dev.snappublisher.snapchat.comdev | Not in the scope | 2026-11-14 |
| blog-antivirus.dev.snappublisher.snapchat.comdev | Not in the scope | 2026-11-14 |
| dev1.snappublisher.snapchat.comdev | Not in the scope | 2026-11-14 |
| antivirus.dev1.snappublisher.snapchat.comdev | Not in the scope | 2026-11-14 |
| antivirus-northamerica.antivirus.dev1.snappublisher.snapchat.comdev | Not in the scope | 2026-11-14 |
| antivirus.devantiviruslax.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| devops.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
| antivirus.devops.snappublisher.snapchat.com | Not in the scope | 2026-11-14 |
17 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.