Bug bounty program · HackerOne
Most upvoted reports3
- #882733ValidInsecure file upload in xiaoai.mi.com Lead to Stored XSSXiaomi · Cross-site Scripting · 2021–117votes
- #879582ValidCORS Misconfiguration, could lead to disclosure of users informationXiaomi · No weakness recorded · 2021–33votes
- #879984ValidDOM-based XSS in d.miwifi.com on IE 11Xiaomi · Cross-site Scripting · 2021–15votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.