Bug bounty program

Stripo Inc

Platform: HackerOne
Bounties: None
Assets in scope: 2
Disclosed reports: 72
Subdomains: 108

Most upvoted reports72

Most upvoted reports of Stripo Inc
Report	Weakness	Disclosed	Bounty	Votes
Open memory dump method leaking customer information ,secret keys , password , source code & admin accountsAnalysed#783360	Access Control	2020-01-31	–	158
Public and secret api key leaked in JavaScript sourceAnalysed#983331	Cryptography	2020-09-29	–	148
[Critical] Unauthorized Cross-Tenant Data Access in Stripo AI Hub Campaign via Deleted Project.Analysed#3459285	Access Control	2026-01-20	–	140
[my.stripo.email] Blind SSRF Vulnerability in Stripo App Export via Missing Endpoints Export Email Message to ZapierAnalysed#2932960	Server-Side Request Forgery	2025-12-01	–	92
stripo.email reflected xssAnalysed#714521	Cross-site Scripting	2019-12-26	–	70
No length on passwordAnalysed#738569	No weakness recorded	2019-12-23	–	64
Able to change password by entering wrong old passwordAnalysed#738899	Cryptography	2019-12-18	–	56
No rate limiting for subscribe email + lead to Cross origin misconfigurationAnalysed#1029723	Input Validation and Logic	2020-11-30	–	54
Able to use 'PREMIUM TEMPLATES' in 'FREE PLAN' at [https://my.stripo.email/cabinet/#/my-templates/]Analysed#1009046	Input Validation and Logic	2021-01-25	–	51
[www.stripo.email] There is no rate limit for contact-us endpointsAnalysed#856305	Access Control	2020-05-26	–	47

Subdomains108

Root

stripo.email108

Scope

Name suggests

First seen

Text file108 names

Subdomains of Stripo Inc
Name	Scope	First seen
test-plugins-e2e-3rd.stripo.emailtest	Not in the scope	2026-11-14
test-plugins-lb.stripo.emailtest	Not in the scope	2026-11-14
test-plugins-swarm.stripo.emailtest	Not in the scope	2026-11-14
tiny.stripo.email	Not in the scope	2026-11-14
trust.stripo.email	Not in the scope	2026-11-14
vpn.stripo.emailvpn	Not in the scope	2026-11-14
vpn-pritunl.stripo.emailvpn	Not in the scope	2026-11-14
www.stripo.email	Not in the scope	2026-11-14

1 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.