Skip to content
Connect AISign inSign up free

Bug bounty program

XX

X / xAI

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
23
Disclosed reports
248
Subdomains
10,596

Most upvoted reports248

All reports
Most upvoted reports of X / xAI
ReportWeaknessDisclosedBountyVotes
Potential pre-auth RCE on Twitter VPNAnalysed#591295Command and Code Injection2019-08-10$20,1601,246
Bypassing Digits origin validation which leads to account takeoverAnalysed#129873Authentication2020-06-24–619
CRLF injectionAnalysed#446271No weakness recorded2019-12-25–439
Read-only application can publish/delete fleetsAnalysed#1032468Access Control2021-01-04–398
Blind XSS on Twitter's internal Big Data panel at █████████████Analysed#1207040Cross-site Scripting2021-07-09–357
Private list members disclosure via GraphQLAnalysed#885539Access Control2020-08-04–346
[Urgent] Invalidating OAuth2 Bearer token makes TweetDeck unavailableAnalysed#210779Denial of Service2019-04-25–323
Bypass Password Authentication for updating email and phone number - Security VulnerabilityAnalysed#770504Authentication2020-02-08–288
Insufficient OAuth callback validation which leads to Periscope account takeoverAnalysed#110293Authentication2019-04-10–277
Insufficient validation on Digits bridgeAnalysed#168116Authentication2020-08-20–263

Subdomains10,596

Root
Scope
Name suggests
First seen
Text file10,596 names
Subdomains of X / xAI
NameScopeFirst seen
denisepic.twitter.comIn scope2026-11-14
denlusk13pic.twitter.comIn scope2026-11-14
dennahzpic.twitter.comIn scope2026-11-14
dennisapricepic.twitter.comIn scope2026-11-14
denverpic.twitter.comIn scope2026-11-14
departmentpic.twitter.comIn scope2026-11-14
depaullaspic.twitter.comIn scope2026-11-14
depechemode.twitter.comIn scope2026-11-14
deplorablespic.twitter.comIn scope2026-11-14
depositpic.twitter.comIn scope2026-11-14
depreciationpic.twitter.comIn scope2026-11-14
derbypic.twitter.comIn scope2026-11-14
derincagpic.twitter.comIn scope2026-11-14
derosetechpic.twitter.comIn scope2026-11-14
derosnayjoelpic.twitter.comIn scope2026-11-14
des2017pic.twitter.comIn scope2026-11-14
deservepic.twitter.comIn scope2026-11-14
design.twitter.comIn scope2026-11-14
desklodgebskpic.twitter.comIn scope2026-11-14
destroyedpic.twitter.comIn scope2026-11-14
detailspic.twitter.comIn scope2026-11-14
detroitpic.twitter.comIn scope2026-11-14
detstartupweekpic.twitter.comIn scope2026-11-14
deutscheboersepic.twitter.comIn scope2026-11-14
dev.twitter.comdevIn scope2026-11-14
www.dev.twitter.comdevIn scope2026-11-14
smfd-akc-08-sr1.devel.twitter.comdevIn scope2026-11-14
develop-er.twitter.comdevIn scope2026-11-14
developer.twitter.comIn scope2026-11-14
developer-staging.twitter.comstagingIn scope2026-11-14
www.developer.twitter.comIn scope2026-11-14
developers.twitter.comIn scope2026-11-14
deviationpic.twitter.comIn scope2026-11-14
devicespic.twitter.comIn scope2026-11-14
devinbookpic.twitter.comIn scope2026-11-14
buchmesse.dewww.twitter.comIn scope2026-11-14
dexibitpic.twitter.comIn scope2026-11-14
dfsny17pic.twitter.comIn scope2026-11-14
dfspic.twitter.comIn scope2026-11-14
audubon.dfw1.twitter.comIn scope2026-11-14
dgtrendspic.twitter.comIn scope2026-11-14
dgwbirchpic.twitter.comIn scope2026-11-14
diabetescurepic.twitter.comIn scope2026-11-14
diagrampic.twitter.comIn scope2026-11-14
diamondpic.twitter.comIn scope2026-11-14
dianacbiggspic.twitter.comIn scope2026-11-14
dickiearmourpic.twitter.comIn scope2026-11-14
dictatorshipspic.twitter.comIn scope2026-11-14
diepic.twitter.comIn scope2026-11-14
dieppe76francepic.twitter.comIn scope2026-11-14
diffbotpic.twitter.comIn scope2026-11-14
difficultpic.twitter.comIn scope2026-11-14
digestedpic.twitter.comIn scope2026-11-14
dighbspic.twitter.comIn scope2026-11-14
digicatapultpic.twitter.comIn scope2026-11-14
diginfernobookpic.twitter.comIn scope2026-11-14
digipop16pic.twitter.comIn scope2026-11-14
digitalalchemypic.twitter.comIn scope2026-11-14
digitalbankingpic.twitter.comIn scope2026-11-14
digitalbankingreportpic.twitter.comIn scope2026-11-14
digitalbankpic.twitter.comIn scope2026-11-14
digitalbitboxpic.twitter.comIn scope2026-11-14
digitalcatapultpic.twitter.comIn scope2026-11-14
digitalepic.twitter.comIn scope2026-11-14
digitaletransformationpic.twitter.comIn scope2026-11-14
digitalfinancepic.twitter.comIn scope2026-11-14
digitalhealthpic.twitter.comIn scope2026-11-14
digitalhumanpic.twitter.comIn scope2026-11-14
digitalidentificationpic.twitter.comIn scope2026-11-14
digitalidpic.twitter.comIn scope2026-11-14
digitalinclusionpic.twitter.comIn scope2026-11-14
digitalisierungpic.twitter.comIn scope2026-11-14
digitalisierungsstrategiepic.twitter.comIn scope2026-11-14
digitalmarketingpic.twitter.comIn scope2026-11-14
digitalmoneyforumpic.twitter.comIn scope2026-11-14
digitalnomadspic.twitter.comIn scope2026-11-14
digitalpic.twitter.comIn scope2026-11-14
digitaltransformationpic.twitter.comIn scope2026-11-14
digitalworldpic.twitter.comIn scope2026-11-14
digitialpic.twitter.comIn scope2026-11-14
digitizationpic.twitter.comIn scope2026-11-14
diligencepic.twitter.comIn scope2026-11-14
dinisguardapic.twitter.comIn scope2026-11-14
diplomatpic.twitter.comIn scope2026-11-14
dippic.twitter.comIn scope2026-11-14
directionalitypic.twitter.comIn scope2026-11-14
directoriodpic.twitter.comIn scope2026-11-14
directresponse.twitter.comIn scope2026-11-14
disagreepic.twitter.comIn scope2026-11-14
disappointmentpic.twitter.comIn scope2026-11-14
disasterpic.twitter.comIn scope2026-11-14
disbersepic.twitter.comIn scope2026-11-14
discountedpic.twitter.comIn scope2026-11-14
discouragedpic.twitter.comIn scope2026-11-14
discover.twitter.comIn scope2026-11-14
discoverandromedapic.twitter.comIn scope2026-11-14
discoverpic.twitter.comIn scope2026-11-14
discovery.twitter.comIn scope2026-11-14
discoverypic.twitter.comIn scope2026-11-14
discussionpic.twitter.comIn scope2026-11-14

10,296 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated