Skip to content
Connect AISign inSign up free

Bug bounty program

SI

Stripo Inc

Open on HackerOneAtlas
Platform
HackerOne
Bounties
None
Assets in scope
2
Disclosed reports
72
Subdomains
108

Most upvoted reports72

All reports
Most upvoted reports of Stripo Inc
ReportWeaknessDisclosedBountyVotes
Open memory dump method leaking customer information ,secret keys , password , source code & admin accountsAnalysed#783360Access Control2020-01-31–158
Public and secret api key leaked in JavaScript sourceAnalysed#983331Cryptography2020-09-29–148
[Critical] Unauthorized Cross-Tenant Data Access in Stripo AI Hub Campaign via Deleted Project.Analysed#3459285Access Control2026-01-20–140
[my.stripo.email] Blind SSRF Vulnerability in Stripo App Export via Missing Endpoints Export Email Message to ZapierAnalysed#2932960Server-Side Request Forgery2025-12-01–92
stripo.email reflected xssAnalysed#714521Cross-site Scripting2019-12-26–70
No length on passwordAnalysed#738569No weakness recorded2019-12-23–64
Able to change password by entering wrong old passwordAnalysed#738899Cryptography2019-12-18–56
No rate limiting for subscribe email + lead to Cross origin misconfigurationAnalysed#1029723Input Validation and Logic2020-11-30–54
Able to use 'PREMIUM TEMPLATES' in 'FREE PLAN' at [https://my.stripo.email/cabinet/#/my-templates/]Analysed#1009046Input Validation and Logic2021-01-25–51
[www.stripo.email] There is no rate limit for contact-us endpointsAnalysed#856305Access Control2020-05-26–47

Subdomains108

Root
Scope
Name suggests:Test and QA
First seen
Text fileClear filters35 names
Subdomains of Stripo Inc
NameScopeFirst seen
demo.stripo.emailtestNot in the scope2026-11-14
plugin-test.stripo.emailtestNot in the scope2026-11-14
staging-demo.stripo.emailstaging, testNot in the scope2026-11-14
stripocdn-test.stripo.emailtestNot in the scope2026-11-14
stripocdn-test1.stripo.emailtestNot in the scope2026-11-14
stripocdn-test2.stripo.emailtestNot in the scope2026-11-14
stripocdn-test3.stripo.emailtestNot in the scope2026-11-14
stripocdn-test4.stripo.emailtestNot in the scope2026-11-14
stripocdn-test5.stripo.emailtestNot in the scope2026-11-14
stripocdn-test6.stripo.emailtestNot in the scope2026-11-14
stripocdn-test7.stripo.emailtestNot in the scope2026-11-14
stripocdn-test8.stripo.emailtestNot in the scope2026-11-14
stripocdn-test9.stripo.emailtestNot in the scope2026-11-14
test-plugins-lb.stripo.emailtestNot in the scope2026-11-14
stripocdn-test10.stripo.emailtestNot in the scope2026-11-14
test-plugins-cdt.stripo.emailtestNot in the scope2026-11-14
test-plugins-e2e.stripo.emailtestNot in the scope2026-11-14
test-plugins-swarm.stripo.emailtestNot in the scope2026-11-14
test.stripocdn-test.stripo.emailtestNot in the scope2026-11-14
test-plugins-e2e-3rd.stripo.emailtestNot in the scope2026-11-14
test.stripocdn-test1.stripo.emailtestNot in the scope2026-11-14
test.stripocdn-test2.stripo.emailtestNot in the scope2026-11-14
test.stripocdn-test3.stripo.emailtestNot in the scope2026-11-14
test.stripocdn-test4.stripo.emailtestNot in the scope2026-11-14
wildcard.stripocdn-test.stripo.emailtestNot in the scope2026-11-14
wildcard.stripocdn-test1.stripo.emailtestNot in the scope2026-11-14
wildcard.stripocdn-test2.stripo.emailtestNot in the scope2026-11-14
wildcard.stripocdn-test3.stripo.emailtestNot in the scope2026-11-14
wildcard.stripocdn-test4.stripo.emailtestNot in the scope2026-11-14
wildcard.stripocdn-test5.stripo.emailtestNot in the scope2026-11-14
wildcard.stripocdn-test6.stripo.emailtestNot in the scope2026-11-14
wildcard.stripocdn-test7.stripo.emailtestNot in the scope2026-11-14
wildcard.stripocdn-test8.stripo.emailtestNot in the scope2026-11-14
wildcard.stripocdn-test9.stripo.emailtestNot in the scope2026-11-14
wildcard.stripocdn-test10.stripo.emailtestNot in the scope2026-11-14

1 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated