Bug bounty program
SN
Snapchat
Most upvoted reports37
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Exposed Kubernetes API - RCE/Exposed CredsAnalysed#455645 | Command and Code Injection | 2021-07-29 | $25,000 | 1,191 |
| Improper Authentication - any user can login as other user with otp/logout & otp/loginAnalysed#921780 | Authentication | 2021-09-03 | – | 972 |
| Delete anyone's content spotlight remotely.Analysed#1819832 | Insecure Direct Object Reference | 2023-03-06 | $15,000 | 801 |
| Github Token Leaked publicly for https://github.sc-corp.netAnalysed#396467 | Cryptography | 2018-10-08 | – | 582 |
| Publicly accessible Continuous Integration ToolAnalysed#313457 | Access Control | 2021-07-29 | – | 562 |
| Access to multiple production Grafana dashboardsAnalysed#663628 | Information Disclosure | 2020-11-04 | $10,000 | 464 |
| Open prod Jenkins instanceAnalysed#231460 | Information Disclosure | 2017-08-19 | $15,000 | 436 |
| Server-Side Request Forgery using Javascript allows to exfill data from Google MetadataAnalysed#530974 | Server-Side Request Forgery | 2020-11-30 | – | 421 |
| Stealing SSO Login Tokens (snappublisher.snapchat.com)Analysed#265943 | Authentication | 2021-07-29 | $7,500 | 244 |
| Leaked JFrog Artifactory username and password exposed on GitHub - https://snapchat.jfrog.ioAnalysed#911606 | Information Disclosure | 2021-08-12 | $15,000 | 137 |
Subdomains1,681
| Name | Scope | First seen |
|---|---|---|
| preview.bitmoji.comstaging | Not in the scope | 2026-11-14 |
| ios-beta.bitmoji.comstaging | Not in the scope | 2026-11-14 |
| api.staging.bitmoji.comapi, staging | Not in the scope | 2026-11-14 |
| staging-api.bitmoji.comapi, staging | Not in the scope | 2026-11-14 |
| staging.api.bitmoji.comapi, staging | Not in the scope | 2026-11-14 |
| staging-connect.bitmoji.comstaging | Not in the scope | 2026-11-14 |
| staging-preview.bitmoji.comstaging | Not in the scope | 2026-11-14 |
| staging.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| staging-vpn.bitstrips.comstaging, vpn | Not in the scope | 2026-11-14 |
| bsdb-staging.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| logs.staging.bitstrips.commonitoring, staging | Not in the scope | 2026-11-14 |
| images.staging.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| staging-cortex.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| staging-render.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| staging-company.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| staging-compose.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| staging-internal.bitstrips.cominternal, staging | Not in the scope | 2026-11-14 |
| staging-admintools.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| staging-character-service.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| rendering-service.staging.us-east.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| btv-rendering-service.staging.us-east.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| www.rendering-service.staging.us-east.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| character-rendering-service.staging.us-east.bitstrips.comstaging | Not in the scope | 2026-11-14 |
| ad-preview.snapchat.comstaging | Not in the scope | 2026-11-14 |
| ads-preprod.snapchat.comstaging | Not in the scope | 2026-11-14 |
| kit-staging.snapchat.comstaging | Not in the scope | 2026-11-14 |
| bolt-staging.snapchat.comstaging | Not in the scope | 2026-11-14 |
| staging-gcp.api.snapchat.comapi, staging | Not in the scope | 2026-11-14 |
| aws.staging.duplex.snapchat.comstaging | Not in the scope | 2026-11-14 |
| beta.snappublisher.snapchat.comstaging | Not in the scope | 2026-11-14 |
| perception-staging.snapchat.comstaging | Not in the scope | 2026-11-14 |
| subscriptions-beta.snapchat.comstaging | Not in the scope | 2026-11-14 |
| stage.snappublisher.snapchat.comstaging | Not in the scope | 2026-11-14 |
| preview.snappublisher.snapchat.comstaging | Not in the scope | 2026-11-14 |
| staging.app-analytics.snapchat.comstaging | Not in the scope | 2026-11-14 |
| staging.snappublisher.snapchat.comstaging | Not in the scope | 2026-11-14 |
| ads-preprod.chef.games.snapchat.comstaging | Not in the scope | 2026-11-14 |
| chat-gateway-stage.chat.snapchat.comstaging | Not in the scope | 2026-11-14 |
| stage-dnm.snappublisher.snapchat.comstaging | Not in the scope | 2026-11-14 |
| staging-us-east1-aws.api.snapchat.comapi, staging | Not in the scope | 2026-11-14 |
| staging.server-analytics.snapchat.comstaging | Not in the scope | 2026-11-14 |
| chat-gateway001-stage.chat.snapchat.comstaging | Not in the scope | 2026-11-14 |
| perception-sandbox-staging.snapchat.comstaging, test | Not in the scope | 2026-11-14 |
| staging-us-central1-gcp.api.snapchat.comapi, staging | Not in the scope | 2026-11-14 |
| us-east1.aws.staging.duplex.snapchat.comstaging | Not in the scope | 2026-11-14 |
| us-west2.aws.staging.duplex.snapchat.comstaging | Not in the scope | 2026-11-14 |
| antivirus.beta.snappublisher.snapchat.comstaging | Not in the scope | 2026-11-14 |
| us-east-1.aws.staging.duplex.snapchat.comstaging | Not in the scope | 2026-11-14 |
| us-west-2.aws.staging.duplex.snapchat.comstaging | Not in the scope | 2026-11-14 |
| antivirus-stage.snappublisher.snapchat.comstaging | Not in the scope | 2026-11-14 |
| staging-us-east-1-bitmoji.api.snapchat.comapi, staging | Not in the scope | 2026-11-14 |
| publishing-preview.snappublisher.snapchat.comstaging | Not in the scope | 2026-11-14 |
| merchandising-preview.snappublisher.snapchat.comstaging | Not in the scope | 2026-11-14 |
| beta-chat-gateway238-prod.snappublisher.snapchat.comstaging | Not in the scope | 2026-11-14 |
| click-chat-gateway001-stage.snappublisher.snapchat.comstaging | Not in the scope | 2026-11-14 |
| chat-gateway082-prod-staging.snappublisher.snapchat.comstaging | Not in the scope | 2026-11-14 |
| gac-rds-external-readonly-preprod.snappublisher.snapchat.comstaging | Not in the scope | 2026-11-14 |
| click-chat-gateway001-stage.4-antivirus.snappublisher.snapchat.comstaging | Not in the scope | 2026-11-14 |
| eagle-prodgac-rds-external-readonly-preprod.snappublisher.snapchat.comstaging | Not in the scope | 2026-11-14 |
17 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.