Skip to content
Connect AISign inSign up free

Bug bounty program

SI

Stripo Inc

Open on HackerOneAtlas
Platform
HackerOne
Bounties
None
Assets in scope
2
Disclosed reports
72
Subdomains
108

Most upvoted reports72

All reports
Most upvoted reports of Stripo Inc
ReportWeaknessDisclosedBountyVotes
Open memory dump method leaking customer information ,secret keys , password , source code & admin accountsAnalysed#783360Access Control2020-01-31–158
Public and secret api key leaked in JavaScript sourceAnalysed#983331Cryptography2020-09-29–148
[Critical] Unauthorized Cross-Tenant Data Access in Stripo AI Hub Campaign via Deleted Project.Analysed#3459285Access Control2026-01-20–140
[my.stripo.email] Blind SSRF Vulnerability in Stripo App Export via Missing Endpoints Export Email Message to ZapierAnalysed#2932960Server-Side Request Forgery2025-12-01–92
stripo.email reflected xssAnalysed#714521Cross-site Scripting2019-12-26–70
No length on passwordAnalysed#738569No weakness recorded2019-12-23–64
Able to change password by entering wrong old passwordAnalysed#738899Cryptography2019-12-18–56
No rate limiting for subscribe email + lead to Cross origin misconfigurationAnalysed#1029723Input Validation and Logic2020-11-30–54
Able to use 'PREMIUM TEMPLATES' in 'FREE PLAN' at [https://my.stripo.email/cabinet/#/my-templates/]Analysed#1009046Input Validation and Logic2021-01-25–51
[www.stripo.email] There is no rate limit for contact-us endpointsAnalysed#856305Access Control2020-05-26–47

Subdomains108

Root
Scope
Name suggests:Staging
First seen
Text fileClear filters19 names
Subdomains of Stripo Inc
NameScopeFirst seen
staging.stripo.emailstagingNot in the scope2026-11-14
svc.staging.stripo.emailstagingNot in the scope2026-11-14
stage-plugin.stripo.emailstagingNot in the scope2026-11-14
staging-demo.stripo.emailstaging, testNot in the scope2026-11-14
stage-account.stripo.emailstagingNot in the scope2026-11-14
stage-plugins.stripo.emailstagingNot in the scope2026-11-14
status-stage0.stripo.emailmonitoring, stagingNot in the scope2026-11-14
graphiti-stage.stripo.emailstagingNot in the scope2026-11-14
staging.empleio.stripo.emailstagingNot in the scope2026-11-14
mau-staging-3-int.stripo.emailstagingNot in the scope2026-11-14
mau-staging-4-int.stripo.emailstagingNot in the scope2026-11-14
mau-staging-5-int.stripo.emailstagingNot in the scope2026-11-14
stripocdn-staging.stripo.emailstagingNot in the scope2026-11-14
stripo-staging-cdn.stripo.emailstagingNot in the scope2026-11-14
stripocdnplugin-staging.stripo.emailstagingNot in the scope2026-11-14
stage-plugins-third-party.stripo.emailstagingNot in the scope2026-11-14
wildcard.stripocdn-staging.stripo.emailstagingNot in the scope2026-11-14
dev-stage-cab-plug-minio-console.stripo.emailadmin, data, dev, stagingNot in the scope2026-11-14
wildcard.stripocdnplugin-staging.stripo.emailstagingNot in the scope2026-11-14

1 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated