Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
35
Disclosed reports
117
Subdomains
821
Vendor on CyberSIXT
Tiktok (2 CVEs, 0 exploited)

Most upvoted reports117

All reports
Most upvoted reports of TikTok
ReportWeaknessDisclosedBountyVotes
Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data ExfiltrationAnalysed#968082Cross-site Scripting2020-11-19–473
Multiple bugs leads to RCE on TikTok for AndroidAnalysed#1065500Access Control2021-03-17–371
[CSRF] TikTok Careers Portal Account TakeoverAnalysed#1010522Cross-Site Request Forgery2020-12-15–366
Reflected XSS in TikTok endpointsAnalysed#1350887Cross-site Scripting2021-10-22–356
RCE on TikTok Ads PortalAnalysed#1024575Command and Code Injection2021-04-15–312
Stored-XSS-ads.tiktok.comAnalysed#2306491Cross-site Scripting2024-10-02–310
Incorrect authorization to the intelbot service leading to ticket informationAnalysed#1328546Authentication2022-02-23$15,000219
IDOR delete any Tickets on ads.tiktok.comAnalysed#1475520Insecure Direct Object Reference2022-03-02–216
Stored XSS on TikTok AdsAnalysed#1504202Cross-site Scripting2022-08-19–201
Blocked user can see live videoAnalysed#1067967Information Disclosure2021-05-28$418198

Subdomains821

Subdomains of TikTok
NameScopeFirst seen
api.tiktok.comapiIn scope2026-11-14
api-m.tiktok.comapiIn scope2026-11-14
api-t.tiktok.comapiIn scope2026-11-14
api-sg.tiktok.comapiIn scope2026-11-14
im-api.tiktok.comapiIn scope2026-11-14
ads-api.tiktok.comapiIn scope2026-11-14
biz-api.tiktok.comapiIn scope2026-11-14
open-api.tiktok.comapiIn scope2026-11-14
im-api-sg.tiktok.comapiIn scope2026-11-14
im-api-va.tiktok.comapiIn scope2026-11-14
api-pns-sg.tiktok.comapiIn scope2026-11-14
api-pns-va.tiktok.comapiIn scope2026-11-14
api-pns.us.tiktok.comapiIn scope2026-11-14
business-api.tiktok.comapiIn scope2026-11-14
feelgood-api.tiktok.comapiIn scope2026-11-14
api.tiktokv.comapiIn scope2026-11-14
api-t.tiktokv.comapiIn scope2026-11-14
api15.tiktokv.comapiIn scope2026-11-14
api16.tiktokv.comapiIn scope2026-11-14
api19.tiktokv.comapiIn scope2026-11-14
api21.tiktokv.comapiIn scope2026-11-14
api30.tiktokv.comapiIn scope2026-11-14
api31.tiktokv.comapiIn scope2026-11-14
api32.tiktokv.comapiIn scope2026-11-14
api-h2.tiktokv.comapiIn scope2026-11-14
api-ru.tiktokv.comapiIn scope2026-11-14
api-t1.tiktokv.comapiIn scope2026-11-14
api-t2.tiktokv.comapiIn scope2026-11-14
api-t3.tiktokv.comapiIn scope2026-11-14
api-tl.tiktokv.comapiIn scope2026-11-14
api-va.tiktokv.comapiIn scope2026-11-14
api3-h2.tiktokv.comapiIn scope2026-11-14
oec-api.tiktokv.comapiIn scope2026-11-14
api-boot.tiktokv.comapiIn scope2026-11-14
api-core.tiktokv.comapiIn scope2026-11-14
api15-h2.tiktokv.comapiIn scope2026-11-14
api16-va.tiktokv.comapiIn scope2026-11-14
api19-h2.tiktokv.comapiIn scope2026-11-14
api19-va.tiktokv.comapiIn scope2026-11-14
api21-h2.tiktokv.comapiIn scope2026-11-14
api21-va.tiktokv.comapiIn scope2026-11-14
api22-va.tiktokv.comapiIn scope2026-11-14
api30-h2.tiktokv.comapiIn scope2026-11-14
api30-va.tiktokv.comapiIn scope2026-11-14
api31-va.tiktokv.comapiIn scope2026-11-14
api-s1-h2.tiktokv.comapiIn scope2026-11-14
api21-quic.tiktokv.comapiIn scope2026-11-14
api22-quic.tiktokv.comapiIn scope2026-11-14
api-core-ru.tiktokv.comapiIn scope2026-11-14
api-core-va.tiktokv.comapiIn scope2026-11-14
api-s1-quic.tiktokv.comapiIn scope2026-11-14
xdevice-api.tiktokv.comapiIn scope2026-11-14
api-h2-eagle.tiktokv.comapiIn scope2026-11-14
api16-core-c.tiktokv.comapiIn scope2026-11-14
api16-core-i.tiktokv.comapiIn scope2026-11-14
api21-core-i.tiktokv.comapiIn scope2026-11-14
api21-core-n.tiktokv.comapiIn scope2026-11-14
api77-normal.tiktokv.comapiIn scope2026-11-14
api16-core-va.tiktokv.comapiIn scope2026-11-14
api19-core-va.tiktokv.comapiIn scope2026-11-14
api21-core-va.tiktokv.comapiIn scope2026-11-14
api22-core-va.tiktokv.comapiIn scope2026-11-14
api15-h2-eagle.tiktokv.comapiIn scope2026-11-14
api16-normal-c.tiktokv.comapiIn scope2026-11-14
api16-normal-i.tiktokv.comapiIn scope2026-11-14
api16-normal-n.tiktokv.comapiIn scope2026-11-14
api21-h2-eagle.tiktokv.comapiIn scope2026-11-14
api22-h2-eagle.tiktokv.comapiIn scope2026-11-14
api22-normal-c.tiktokv.comapiIn scope2026-11-14
api30-h2-eagle.tiktokv.comapiIn scope2026-11-14
api16-normal-v4.tiktokv.comapiIn scope2026-11-14
api16-normal-v6.tiktokv.comapiIn scope2026-11-14
api22-normal-v4.tiktokv.comapiIn scope2026-11-14
api3-core-c-alisg.tiktokv.comapiIn scope2026-11-14
api3-core-n-alisg.tiktokv.comapiIn scope2026-11-14
api9-core-c-alisg.tiktokv.comapiIn scope2026-11-14
api16-core-c-alisg.tiktokv.comapiIn scope2026-11-14
api16-core-i-alisg.tiktokv.comapiIn scope2026-11-14
api16-core-n-alisg.tiktokv.comapiIn scope2026-11-14
api19-core-c-alisg.tiktokv.comapiIn scope2026-11-14
api21-core-c-alisg.tiktokv.comapiIn scope2026-11-14
api21-core-i-alisg.tiktokv.comapiIn scope2026-11-14
api21-core-n-alisg.tiktokv.comapiIn scope2026-11-14
api22-core-c-alisg.tiktokv.comapiIn scope2026-11-14
api22-core-h-alisg.tiktokv.comapiIn scope2026-11-14
api22-core-n-alisg.tiktokv.comapiIn scope2026-11-14
api24-normal-alisg.tiktokv.comapiIn scope2026-11-14
api30-core-c-alisg.tiktokv.comapiIn scope2026-11-14
api31-core-c-alisg.tiktokv.comapiIn scope2026-11-14
api31-core-q-alisg.tiktokv.comapiIn scope2026-11-14
api32-core-q-alisg.tiktokv.comapiIn scope2026-11-14
api33-core-c-alisg.tiktokv.comapiIn scope2026-11-14
api33-core-q-alisg.tiktokv.comapiIn scope2026-11-14
api53-core-c-alisg.tiktokv.comapiIn scope2026-11-14
api55-core-c-alisg.tiktokv.comapiIn scope2026-11-14
api58-core-c-alisg.tiktokv.comapiIn scope2026-11-14
api61-core-c-alisg.tiktokv.comapiIn scope2026-11-14
api77-core-c-alisg.tiktokv.comapiIn scope2026-11-14
api16-core-c4-alisg.tiktokv.comapiIn scope2026-11-14
api16-core-c6-alisg.tiktokv.comapiIn scope2026-11-14

792 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.