Bug bounty program
SN
Snapchat
Most upvoted reports37
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Exposed Kubernetes API - RCE/Exposed CredsAnalysed#455645 | Command and Code Injection | 2021-07-29 | $25,000 | 1,191 |
| Improper Authentication - any user can login as other user with otp/logout & otp/loginAnalysed#921780 | Authentication | 2021-09-03 | – | 972 |
| Delete anyone's content spotlight remotely.Analysed#1819832 | Insecure Direct Object Reference | 2023-03-06 | $15,000 | 801 |
| Github Token Leaked publicly for https://github.sc-corp.netAnalysed#396467 | Cryptography | 2018-10-08 | – | 582 |
| Publicly accessible Continuous Integration ToolAnalysed#313457 | Access Control | 2021-07-29 | – | 562 |
| Access to multiple production Grafana dashboardsAnalysed#663628 | Information Disclosure | 2020-11-04 | $10,000 | 464 |
| Open prod Jenkins instanceAnalysed#231460 | Information Disclosure | 2017-08-19 | $15,000 | 436 |
| Server-Side Request Forgery using Javascript allows to exfill data from Google MetadataAnalysed#530974 | Server-Side Request Forgery | 2020-11-30 | – | 421 |
| Stealing SSO Login Tokens (snappublisher.snapchat.com)Analysed#265943 | Authentication | 2021-07-29 | $7,500 | 244 |
| Leaked JFrog Artifactory username and password exposed on GitHub - https://snapchat.jfrog.ioAnalysed#911606 | Information Disclosure | 2021-08-12 | $15,000 | 137 |
Subdomains1,681
| Name | Scope | First seen |
|---|---|---|
| mail.scan.memail | Not in the scope | 2026-11-14 |
| mail.snapchat.commail | Not in the scope | 2026-11-14 |
| o1.mail.snapchat.commail | Not in the scope | 2026-11-14 |
| o2.mail.snapchat.commail | Not in the scope | 2026-11-14 |
| o3.mail.snapchat.commail | Not in the scope | 2026-11-14 |
| o4.mail.snapchat.commail | Not in the scope | 2026-11-14 |
| o6.mail.snapchat.commail | Not in the scope | 2026-11-14 |
| o9.mail.snapchat.commail | Not in the scope | 2026-11-14 |
| o10.mail.snapchat.commail | Not in the scope | 2026-11-14 |
| o14.mail.m.snapchat.commail | Not in the scope | 2026-11-14 |
| o15.mail.m.snapchat.commail | Not in the scope | 2026-11-14 |
| o18.mail.n.snapchat.commail | Not in the scope | 2026-11-14 |
| mail.support.snapchat.commail | Not in the scope | 2026-11-14 |
| o16.mail15.e.snapchat.commail | Not in the scope | 2026-11-14 |
| o17.mail15.e.snapchat.commail | Not in the scope | 2026-11-14 |
| mail2.support.snapchat.commail | Not in the scope | 2026-11-14 |
| mx.snappublisher.snapchat.commail | Not in the scope | 2026-11-14 |
| owa.snappublisher.snapchat.commail | Not in the scope | 2026-11-14 |
| imap.snappublisher.snapchat.commail | Not in the scope | 2026-11-14 |
| mail.snappublisher.snapchat.commail | Not in the scope | 2026-11-14 |
| pop3.snappublisher.snapchat.commail | Not in the scope | 2026-11-14 |
| smtp.snappublisher.snapchat.commail | Not in the scope | 2026-11-14 |
| mail1.snappublisher.snapchat.commail | Not in the scope | 2026-11-14 |
| mail2.snappublisher.snapchat.commail | Not in the scope | 2026-11-14 |
| webmail.snappublisher.snapchat.commail | Not in the scope | 2026-11-14 |
| exchange.snappublisher.snapchat.commail | Not in the scope | 2026-11-14 |
| autodiscover.snappublisher.snapchat.commail | Not in the scope | 2026-11-14 |
| mail.antivirus.snappublisher.snapchat.commail | Not in the scope | 2026-11-14 |
| kr.mail.antivirus.snappublisher.snapchat.commail | Not in the scope | 2026-11-14 |
| lipublishers.imap.snappublisher.snapchat.commail | Not in the scope | 2026-11-14 |
| mail2antivirus.pl.snappublisher.snapchat.commail | Not in the scope | 2026-11-14 |
| germany-antivirus-mail.snappublisher.snapchat.commail | Not in the scope | 2026-11-14 |
| chat-gateway188-prod-smtp.snappublisher.snapchat.commail | Not in the scope | 2026-11-14 |
| o8.mail.spectacles.commail | Not in the scope | 2026-11-14 |
17 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.