Skip to content
Connect AISign inSign up free

Bug bounty program

XX

X / xAI

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
23
Disclosed reports
248
Subdomains
10,596

Most upvoted reports248

All reports
Most upvoted reports of X / xAI
ReportWeaknessDisclosedBountyVotes
Potential pre-auth RCE on Twitter VPNAnalysed#591295Command and Code Injection2019-08-10$20,1601,246
Bypassing Digits origin validation which leads to account takeoverAnalysed#129873Authentication2020-06-24–619
CRLF injectionAnalysed#446271No weakness recorded2019-12-25–439
Read-only application can publish/delete fleetsAnalysed#1032468Access Control2021-01-04–398
Blind XSS on Twitter's internal Big Data panel at █████████████Analysed#1207040Cross-site Scripting2021-07-09–357
Private list members disclosure via GraphQLAnalysed#885539Access Control2020-08-04–346
[Urgent] Invalidating OAuth2 Bearer token makes TweetDeck unavailableAnalysed#210779Denial of Service2019-04-25–323
Bypass Password Authentication for updating email and phone number - Security VulnerabilityAnalysed#770504Authentication2020-02-08–288
Insufficient OAuth callback validation which leads to Periscope account takeoverAnalysed#110293Authentication2019-04-10–277
Insufficient validation on Digits bridgeAnalysed#168116Authentication2020-08-20–263

Subdomains10,596

Root
Scope
Name suggests
First seen
Text file10,596 names
Subdomains of X / xAI
NameScopeFirst seen
discussionspic.twitter.comIn scope2026-11-14
discusspic.twitter.comIn scope2026-11-14
disgustingpic.twitter.comIn scope2026-11-14
diskpic.twitter.comIn scope2026-11-14
disneypic.twitter.comIn scope2026-11-14
dispic.twitter.comIn scope2026-11-14
displacepic.twitter.comIn scope2026-11-14
displaypic.twitter.comIn scope2026-11-14
disrupterspic.twitter.comIn scope2026-11-14
disruptionhubpic.twitter.comIn scope2026-11-14
disruptionpic.twitter.comIn scope2026-11-14
disruptivedeanpic.twitter.comIn scope2026-11-14
disruptiveinnovationpic.twitter.comIn scope2026-11-14
disruptparispic.twitter.comIn scope2026-11-14
disseminatepic.twitter.comIn scope2026-11-14
distledgerpic.twitter.comIn scope2026-11-14
distlyticspic.twitter.comIn scope2026-11-14
distortedpic.twitter.comIn scope2026-11-14
distributedledgerpic.twitter.comIn scope2026-11-14
distributionpic.twitter.comIn scope2026-11-14
divepic.twitter.comIn scope2026-11-14
divergencepic.twitter.comIn scope2026-11-14
diversity.twitter.comIn scope2026-11-14
diversitypic.twitter.comIn scope2026-11-14
divrajpic.twitter.comIn scope2026-11-14
dixonscarphonepic.twitter.comIn scope2026-11-14
djggmlpic.twitter.comIn scope2026-11-14
dksdonutspic.twitter.comIn scope2026-11-14
dlfpic.twitter.comIn scope2026-11-14
dlpic.twitter.comIn scope2026-11-14
dltechnologyukpic.twitter.comIn scope2026-11-14
dltpic.twitter.comIn scope2026-11-14
dlxpic.twitter.comIn scope2026-11-14
dmapic.twitter.comIn scope2026-11-14
dmiawards17pic.twitter.comIn scope2026-11-14
partnerdata01.dmz1.twitter.comIn scope2026-11-14
service01.dmz1.twitter.comIn scope2026-11-14
spiderduck01.dmz1.twitter.comIn scope2026-11-14
spiderduck02.dmz1.twitter.comIn scope2026-11-14
spiderduck03.dmz1.twitter.comIn scope2026-11-14
www01.dmz1.twitter.comIn scope2026-11-14
www02.dmz1.twitter.comIn scope2026-11-14
dnamoneypic.twitter.comIn scope2026-11-14
dndpic.twitter.comIn scope2026-11-14
dngusevpic.twitter.comIn scope2026-11-14
doapic.twitter.comIn scope2026-11-14
docid.twitter.comIn scope2026-11-14
doctorowpic.twitter.comIn scope2026-11-14
doctorswithoutborderspic.twitter.comIn scope2026-11-14
documentspic.twitter.comIn scope2026-11-14
dogecoinpic.twitter.comIn scope2026-11-14
dogepic.twitter.comIn scope2026-11-14
dogs.twitter.comIn scope2026-11-14
dogsoftwitterpic.twitter.comIn scope2026-11-14
dogspic.twitter.comIn scope2026-11-14
dollarpic.twitter.comIn scope2026-11-14
dollarvigilantepic.twitter.comIn scope2026-11-14
dollpic.twitter.comIn scope2026-11-14
domesticgoddesspic.twitter.comIn scope2026-11-14
dominateinsteadofstrugglepic.twitter.comIn scope2026-11-14
dominatespic.twitter.comIn scope2026-11-14
dominicanrepublicpic.twitter.comIn scope2026-11-14
dominikgpic.twitter.comIn scope2026-11-14
donate.twitter.comIn scope2026-11-14
donationspic.twitter.comIn scope2026-11-14
donepic.twitter.comIn scope2026-11-14
donkeyballspic.twitter.comIn scope2026-11-14
donnafoxpic.twitter.comIn scope2026-11-14
donotlosehopepic.twitter.comIn scope2026-11-14
donpepperspic.twitter.comIn scope2026-11-14
dopic.twitter.comIn scope2026-11-14
dory.twitter.comIn scope2026-11-14
dota2.twitter.comIn scope2026-11-14
dotchpic.twitter.comIn scope2026-11-14
dotfinancelivepic.twitter.comIn scope2026-11-14
double-spendingpic.twitter.comIn scope2026-11-14
dougcoltartpic.twitter.comIn scope2026-11-14
dougmcwpic.twitter.comIn scope2026-11-14
dovepic.twitter.comIn scope2026-11-14
dowhatyoulovepic.twitter.comIn scope2026-11-14
downgradepic.twitter.comIn scope2026-11-14
download.twitter.comIn scope2026-11-14
downpic.twitter.comIn scope2026-11-14
downsidepic.twitter.comIn scope2026-11-14
downtickpic.twitter.comIn scope2026-11-14
downtimepic.twitter.comIn scope2026-11-14
downtownfrankpic.twitter.comIn scope2026-11-14
downtrendpic.twitter.comIn scope2026-11-14
dowpic.twitter.comIn scope2026-11-14
doxpic.twitter.comIn scope2026-11-14
doyouevenlistpic.twitter.comIn scope2026-11-14
dpaucklandpic.twitter.comIn scope2026-11-14
dpd17pic.twitter.comIn scope2026-11-14
dpic.twitter.comIn scope2026-11-14
dpipic.twitter.comIn scope2026-11-14
draghipic.twitter.comIn scope2026-11-14
draintheswamppic.twitter.comIn scope2026-11-14
drchrisdolanpic.twitter.comIn scope2026-11-14
dreamactpic.twitter.comIn scope2026-11-14
dreamforce.twitter.comIn scope2026-11-14

10,296 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated