Reddit Bug Bounty Program on Hackerone

{ "allows_bounty_splitting": true, "average_time_to_bounty_awarded": 88, "average_time_to_first_program_response": 1, "average_time_to_report_resolved": 1406, "handle": "reddit", "id": 0, "managed_program": true, "name": "Reddit", "offers_bounties": true, "offers_swag": false, "response_efficiency_percentage": 90, "submission_state": "open", "url": "https://hackerone.com/reddit", "website": "https://www.reddit.com", "targets": { "in_scope": [ { "asset_identifier": "*.reddit.com", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Core asset]", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.redditblog.com", "asset_type": "WILDCARD", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Non-core asset]", "integrity_requirement": "medium", "max_severity": "medium" }, { "asset_identifier": "*.reddithelp.com", "asset_type": "WILDCARD", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Non-core asset]", "integrity_requirement": "medium", "max_severity": "medium" }, { "asset_identifier": "*.redditinc.com", "asset_type": "WILDCARD", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Non-core asset]\nVendor hosted and managed CMS for corporate / marketing site. It is domain whitelisted for reddit.com functionality so if you can string an attack together with reddit.com then this becomes super interesting.", "integrity_requirement": "low", "max_severity": "medium" }, { "asset_identifier": "*.redditmedia.com", "asset_type": "WILDCARD", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Non-core asset]", "integrity_requirement": "high", "max_severity": "high" }, { "asset_identifier": "*.snooguts.net", "asset_type": "WILDCARD", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Core asset]\nThis is our internal domain for \"intranet\" related services. Accessible to the internet should be either 1) an OAuth proxy that gates access to backend services (SCM, admin tooling, CI/CD, etc.) or 2) k8s public ingresses. \n\nThis domain isn't necessarily \"private\" so leaking the domain isn't interesting, but certainly bypassing proxy auth wall or finding juicy targets on that domain is of interest.", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "*.spiketrap.io", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Non-core asset]", "integrity_requirement": null, "max_severity": "medium" }, { "asset_identifier": "Android App", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Core asset]", "integrity_requirement": null, "max_severity": "high" }, { "asset_identifier": "Core Assets", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Non-Core Assets", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "accounts.reddit.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Core asset]\nAuthentication / authorization service for reddit.com", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "ads.reddit.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Core asset]", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "amp.reddit.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "low", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Core asset]\nThis service houses our AMP generated pages for search engine optimization. ", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "api.reddit.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Core asset]\nThe Reddit API is used for programmatic access. Please use your own test accounts and do not try to access the private data of other users/mods/admins or Reddit employees. Authentication ([OAUTH](https://github.com/reddit-archive/reddit/wiki/OAuth2)) and authorization are especially important.\n\nDocs are available at: https://www.reddit.com/dev/api\n\nPlease follow Reddit's [rules for API access](https://github.com/reddit-archive/reddit/wiki/API).", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "business.reddithelp.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Non-core asset]\nReddit maintains a SFDC tenant for customer management for our advertisers. SFDC bugs aren't eligible for payout, but misconfigurations that are Reddit's responsibility are.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "developers.reddit.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Core asset]", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "gateway.reddit.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Core asset]\nFrontdoor service that handles dispensation to backend microservices. Relies on oauth authentication", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "gql.reddit.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Core asset]\nGraphQL implementation for Reddit accessing all our internal things requiring OAuth.", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "iOS App", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Core asset]", "integrity_requirement": null, "max_severity": "high" }, { "asset_identifier": "m.reddit.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Core asset]\nMobile webapp (we call mweb) for Reddit. Use a mobile UA to access. ", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "matrix.redditspace.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Core asset]", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "meta-api.reddit.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Core asset]\nHouses Reddit's smart contracts based on Ethereum, which is called Community Points and ties in with the Vault functionality within Reddit's official mobile apps.", "integrity_requirement": "high", "max_severity": "high" }, { "asset_identifier": "mod.reddit.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Core asset]\nThe Reddit modmail interface is used by moderators to take moderator actions and view reports. Please test against your own subreddits and not those belonging to other users/mods/admins.", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "new.reddit.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Core asset]\nThe Reddit redesign. Follow the same rules as `www.reddit.com`.", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "redditforbusiness.com", "asset_type": "URL", "availability_requirement": "low", "confidentiality_requirement": "none", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Non-core asset]\nThird party hosted CMS platform on WebFlow", "integrity_requirement": "medium", "max_severity": "medium" }, { "asset_identifier": "sh.reddit.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Core asset]", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "strapi.reddit.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Core asset]\nOur streaming api.", "integrity_requirement": "high", "max_severity": "critical" } ], "out_of_scope": [ { "asset_identifier": "memorable.io", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "reddit.secure.force.com", "asset_type": "URL", "availability_requirement": "low", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "[Non-core asset]\nReddit maintains a SFDC tenant for customer management for our advertisers. SFDC bugs aren't eligible for payout, but misconfigurations that are Reddit's responsibility are. ", "integrity_requirement": "medium", "max_severity": "none" } ] } }

Reddit

In scope

Recent changes

Community reports

Your notes

Out of scope