Skip to content
Connect AISign inSign up free

Bug bounty program

XX

X / xAI

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
23
Disclosed reports
248
Subdomains
10,596

Most upvoted reports248

All reports
Most upvoted reports of X / xAI
ReportWeaknessDisclosedBountyVotes
Potential pre-auth RCE on Twitter VPNAnalysed#591295Command and Code Injection2019-08-10$20,1601,246
Bypassing Digits origin validation which leads to account takeoverAnalysed#129873Authentication2020-06-24–619
CRLF injectionAnalysed#446271No weakness recorded2019-12-25–439
Read-only application can publish/delete fleetsAnalysed#1032468Access Control2021-01-04–398
Blind XSS on Twitter's internal Big Data panel at █████████████Analysed#1207040Cross-site Scripting2021-07-09–357
Private list members disclosure via GraphQLAnalysed#885539Access Control2020-08-04–346
[Urgent] Invalidating OAuth2 Bearer token makes TweetDeck unavailableAnalysed#210779Denial of Service2019-04-25–323
Bypass Password Authentication for updating email and phone number - Security VulnerabilityAnalysed#770504Authentication2020-02-08–288
Insufficient OAuth callback validation which leads to Periscope account takeoverAnalysed#110293Authentication2019-04-10–277
Insufficient validation on Digits bridgeAnalysed#168116Authentication2020-08-20–263

Subdomains10,596

Root
Scope
Name suggests
First seen
Text file10,596 names
Subdomains of X / xAI
NameScopeFirst seen
businesslessonspic.twitter.comIn scope2026-11-14
businesspic.twitter.comIn scope2026-11-14
businessstrategypic.twitter.comIn scope2026-11-14
busycitypic.twitter.comIn scope2026-11-14
butinonepic.twitter.comIn scope2026-11-14
butpic.twitter.comIn scope2026-11-14
butterpic.twitter.comIn scope2026-11-14
buttons.twitter.comIn scope2026-11-14
buyerpic.twitter.comIn scope2026-11-14
buyersremorsepic.twitter.comIn scope2026-11-14
buyingpic.twitter.comIn scope2026-11-14
buypic.twitter.comIn scope2026-11-14
buythemacloudpic.twitter.comIn scope2026-11-14
buzzfeed.twitter.comIn scope2026-11-14
buzzvaultpic.twitter.comIn scope2026-11-14
bxfintech16pic.twitter.comIn scope2026-11-14
byepic.twitter.comIn scope2026-11-14
bypic.twitter.comIn scope2026-11-14
byrefugeesforrefugeespic.twitter.comIn scope2026-11-14
bysamropic.twitter.comIn scope2026-11-14
c.twitter.comIn scope2026-11-14
c0nveypic.twitter.comIn scope2026-11-14
c1aranmurraypic.twitter.comIn scope2026-11-14
cabspic.twitter.comIn scope2026-11-14
cafeteriaperez.twitter.comIn scope2026-11-14
cakepic.twitter.comIn scope2026-11-14
calanderpic.twitter.comIn scope2026-11-14
calcuttapic.twitter.comIn scope2026-11-14
calendar.twitter.comIn scope2026-11-14
callpic.twitter.comIn scope2026-11-14
callspic.twitter.comIn scope2026-11-14
camachocryptopic.twitter.comIn scope2026-11-14
cambconsultantspic.twitter.comIn scope2026-11-14
cambridge105pic.twitter.comIn scope2026-11-14
cameronhighlandspic.twitter.comIn scope2026-11-14
cameroonpic.twitter.comIn scope2026-11-14
camharveypic.twitter.comIn scope2026-11-14
campaignpic.twitter.comIn scope2026-11-14
campingin4wordspic.twitter.comIn scope2026-11-14
campingpic.twitter.comIn scope2026-11-14
camppic.twitter.comIn scope2026-11-14
campusmvnupic.twitter.comIn scope2026-11-14
canadabitcoinpic.twitter.comIn scope2026-11-14
canadagicpic.twitter.comIn scope2026-11-14
canadapic.twitter.comIn scope2026-11-14
canadianthanksgivingpic.twitter.comIn scope2026-11-14
canary.twitter.comstagingIn scope2026-11-14
candidatespic.twitter.comIn scope2026-11-14
candlepic.twitter.comIn scope2026-11-14
canonphotographypic.twitter.comIn scope2026-11-14
canonukandiepic.twitter.comIn scope2026-11-14
canpic.twitter.comIn scope2026-11-14
cantalkpic.twitter.comIn scope2026-11-14
cantstoptheworkpic.twitter.comIn scope2026-11-14
capabilitiespic.twitter.comIn scope2026-11-14
capeclearpic.twitter.comIn scope2026-11-14
capgeminiconsulpic.twitter.comIn scope2026-11-14
capgeminipic.twitter.comIn scope2026-11-14
capitalismpic.twitter.comIn scope2026-11-14
capitapic.twitter.comIn scope2026-11-14
capitolpic.twitter.comIn scope2026-11-14
capitulationpic.twitter.comIn scope2026-11-14
cappic.twitter.comIn scope2026-11-14
caps.twitter.comIn scope2026-11-14
caps-staging.twitter.comstagingIn scope2026-11-14
capsvrangerspic.twitter.comIn scope2026-11-14
captionthispic.twitter.comIn scope2026-11-14
capturedpic.twitter.comIn scope2026-11-14
carbonedpic.twitter.comIn scope2026-11-14
cardmageddonpic.twitter.comIn scope2026-11-14
cardpic.twitter.comIn scope2026-11-14
cards.twitter.comIn scope2026-11-14
cards-beta.twitter.comstagingIn scope2026-11-14
cards-dev.twitter.comdevIn scope2026-11-14
cards-frame.twitter.comIn scope2026-11-14
cards-staging.twitter.comstagingIn scope2026-11-14
cardsdev.twitter.comIn scope2026-11-14
cardspic.twitter.comIn scope2026-11-14
careers.twitter.comIn scope2026-11-14
carefulpic.twitter.comIn scope2026-11-14
carelboshpic.twitter.comIn scope2026-11-14
carepic.twitter.comIn scope2026-11-14
carers2017pic.twitter.comIn scope2026-11-14
caring4migrantspic.twitter.comIn scope2026-11-14
carlbildtpic.twitter.comIn scope2026-11-14
carminadupic.twitter.comIn scope2026-11-14
carnagepic.twitter.comIn scope2026-11-14
carnivorypic.twitter.comIn scope2026-11-14
carolinapic.twitter.comIn scope2026-11-14
carpenoctompic.twitter.comIn scope2026-11-14
carspic.twitter.comIn scope2026-11-14
cartermckelvainpic.twitter.comIn scope2026-11-14
carvkpic.twitter.comIn scope2026-11-14
casanvarpic.twitter.comIn scope2026-11-14
casepic.twitter.comIn scope2026-11-14
cashflowquadrantpic.twitter.comIn scope2026-11-14
cashpic.twitter.comIn scope2026-11-14
cashpluspic.twitter.comIn scope2026-11-14
cashrevpic.twitter.comIn scope2026-11-14
casinospic.twitter.comIn scope2026-11-14

10,296 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated