Bug bounty program

X / xAI

Platform: HackerOne
Bounties: Pays
Assets in scope: 23
Disclosed reports: 248
Subdomains: 10,596

Most upvoted reports248

Most upvoted reports of X / xAI
Report	Weakness	Disclosed	Bounty	Votes
Potential pre-auth RCE on Twitter VPNAnalysed#591295	Command and Code Injection	2019-08-10	$20,160	1,246
Bypassing Digits origin validation which leads to account takeoverAnalysed#129873	Authentication	2020-06-24	–	619
CRLF injectionAnalysed#446271	No weakness recorded	2019-12-25	–	439
Read-only application can publish/delete fleetsAnalysed#1032468	Access Control	2021-01-04	–	398
Blind XSS on Twitter's internal Big Data panel at █████████████Analysed#1207040	Cross-site Scripting	2021-07-09	–	357
Private list members disclosure via GraphQLAnalysed#885539	Access Control	2020-08-04	–	346
[Urgent] Invalidating OAuth2 Bearer token makes TweetDeck unavailableAnalysed#210779	Denial of Service	2019-04-25	–	323
Bypass Password Authentication for updating email and phone number - Security VulnerabilityAnalysed#770504	Authentication	2020-02-08	–	288
Insufficient OAuth callback validation which leads to Periscope account takeoverAnalysed#110293	Authentication	2019-04-10	–	277
Insufficient validation on Digits bridgeAnalysed#168116	Authentication	2020-08-20	–	263

Subdomains10,596

Root:twitter.com

Scope

Name suggests:Sign-in

First seen

Text fileClear filters4 names

Subdomains of X / xAI
Name	Scope	First seen
auth.local.twitter.comauth, dev	In scope	2026-11-14
auth-staging.local.twitter.comauth, dev, staging	In scope	2026-11-14
login.twitter.comauth	In scope	2026-11-14
oauth.twitter.comauth	In scope	2026-11-14

10,296 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.