Skip to content
Connect AISign inSign up free

Bug bounty program

XX

X / xAI

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
23
Disclosed reports
248
Subdomains
10,596

Most upvoted reports248

All reports
Most upvoted reports of X / xAI
ReportWeaknessDisclosedBountyVotes
Potential pre-auth RCE on Twitter VPNAnalysed#591295Command and Code Injection2019-08-10$20,1601,246
Bypassing Digits origin validation which leads to account takeoverAnalysed#129873Authentication2020-06-24–619
CRLF injectionAnalysed#446271No weakness recorded2019-12-25–439
Read-only application can publish/delete fleetsAnalysed#1032468Access Control2021-01-04–398
Blind XSS on Twitter's internal Big Data panel at █████████████Analysed#1207040Cross-site Scripting2021-07-09–357
Private list members disclosure via GraphQLAnalysed#885539Access Control2020-08-04–346
[Urgent] Invalidating OAuth2 Bearer token makes TweetDeck unavailableAnalysed#210779Denial of Service2019-04-25–323
Bypass Password Authentication for updating email and phone number - Security VulnerabilityAnalysed#770504Authentication2020-02-08–288
Insufficient OAuth callback validation which leads to Periscope account takeoverAnalysed#110293Authentication2019-04-10–277
Insufficient validation on Digits bridgeAnalysed#168116Authentication2020-08-20–263

Subdomains10,596

Root:twitter.com
Scope:In scope
Name suggests
First seen
Text fileClear filters9,943 names
Subdomains of X / xAI
NameScopeFirst seen
0.twitter.comIn scope2026-11-14
000pic.twitter.comIn scope2026-11-14
00a7c7f1abc8fc.twitter.comIn scope2026-11-14
00estpic.twitter.comIn scope2026-11-14
00yearsagopic.twitter.comIn scope2026-11-14
01217070121pic.twitter.comIn scope2026-11-14
01pic.twitter.comIn scope2026-11-14
71.095pic.twitter.comIn scope2026-11-14
0pic.twitter.comIn scope2026-11-14
bank4.0pic.twitter.comIn scope2026-11-14
1000pic.twitter.comIn scope2026-11-14
100eyarsagopic.twitter.comIn scope2026-11-14
100pic.twitter.comIn scope2026-11-14
100yaersagopic.twitter.comIn scope2026-11-14
100yearaagopic.twitter.comIn scope2026-11-14
100yearagopic.twitter.comIn scope2026-11-14
100yearsagojulypic.twitter.comIn scope2026-11-14
100yearsagopic.twitter.comIn scope2026-11-14
100yearsaogpic.twitter.comIn scope2026-11-14
100yearsaopic.twitter.comIn scope2026-11-14
100yearsgaopic.twitter.comIn scope2026-11-14
100yearsgopic.twitter.comIn scope2026-11-14
100yearssagopic.twitter.comIn scope2026-11-14
100yerasagopic.twitter.comIn scope2026-11-14
101pic.twitter.comIn scope2026-11-14
108pic.twitter.comIn scope2026-11-14
10ampic.twitter.comIn scope2026-11-14
10kpic.twitter.comIn scope2026-11-14
10mpic.twitter.comIn scope2026-11-14
10pic.twitter.comIn scope2026-11-14
10xpic.twitter.comIn scope2026-11-14
11181pic.twitter.comIn scope2026-11-14
1180pic.twitter.comIn scope2026-11-14
1197590096041725952pic.twitter.comIn scope2026-11-14
11fsteampic.twitter.comIn scope2026-11-14
11pic.twitter.comIn scope2026-11-14
165.11pic.twitter.comIn scope2026-11-14
11thpic.twitter.comIn scope2026-11-14
1200pic.twitter.comIn scope2026-11-14
12mopic.twitter.comIn scope2026-11-14
12pic.twitter.comIn scope2026-11-14
13-9pic.twitter.comIn scope2026-11-14
1308pic.twitter.comIn scope2026-11-14
130pic.twitter.comIn scope2026-11-14
133pic.twitter.comIn scope2026-11-14
1375pic.twitter.comIn scope2026-11-14
1378pic.twitter.comIn scope2026-11-14
13pic.twitter.comIn scope2026-11-14
13xxpic.twitter.comIn scope2026-11-14
1474pic.twitter.comIn scope2026-11-14
14thpic.twitter.comIn scope2026-11-14
1500-2500pic.twitter.comIn scope2026-11-14
150mpic.twitter.comIn scope2026-11-14
150pic.twitter.comIn scope2026-11-14
1585pic.twitter.comIn scope2026-11-14
15pic.twitter.comIn scope2026-11-14
16daysofactivism2019pic.twitter.comIn scope2026-11-14
16dayspic.twitter.comIn scope2026-11-14
1750pic.twitter.comIn scope2026-11-14
1776pic.twitter.comIn scope2026-11-14
18000pic.twitter.comIn scope2026-11-14
18458pic.twitter.comIn scope2026-11-14
1880pic.twitter.comIn scope2026-11-14
18pic.twitter.comIn scope2026-11-14
1916pic.twitter.comIn scope2026-11-14
1944pic.twitter.comIn scope2026-11-14
1948pic.twitter.comIn scope2026-11-14
1949jeepsterpic.twitter.comIn scope2026-11-14
1961pic.twitter.comIn scope2026-11-14
1980pic.twitter.comIn scope2026-11-14
1993pic.twitter.comIn scope2026-11-14
1995pic.twitter.comIn scope2026-11-14
1996pic.twitter.comIn scope2026-11-14
1997pic.twitter.comIn scope2026-11-14
1999pic.twitter.comIn scope2026-11-14
108.19pic.twitter.comIn scope2026-11-14
1apic.twitter.comIn scope2026-11-14
1brokercompic.twitter.comIn scope2026-11-14
1brokerpic.twitter.comIn scope2026-11-14
1daypic.twitter.comIn scope2026-11-14
1hbodfhu7nx1rjzmpudvfiidtpg2o24mmipic.twitter.comIn scope2026-11-14
1mbpic.twitter.comIn scope2026-11-14
1pic.twitter.comIn scope2026-11-14
2.twitter.comIn scope2026-11-14
2005pic.twitter.comIn scope2026-11-14
2006pic.twitter.comIn scope2026-11-14
2007-2017pic.twitter.comIn scope2026-11-14
2007neveragainpic.twitter.comIn scope2026-11-14
2007pic.twitter.comIn scope2026-11-14
2008-2016pic.twitter.comIn scope2026-11-14
2008-2017pic.twitter.comIn scope2026-11-14
2008pic.twitter.comIn scope2026-11-14
2009pic.twitter.comIn scope2026-11-14
200bnpic.twitter.comIn scope2026-11-14
200pic.twitter.comIn scope2026-11-14
2010.twitter.comIn scope2026-11-14
2010pic.twitter.comIn scope2026-11-14
2011.twitter.comIn scope2026-11-14
2011pic.twitter.comIn scope2026-11-14
2012.twitter.comIn scope2026-11-14

10,296 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated