HexBrain
Sign in

Browse / Cloudflare Public Bug Bounty

Cloudflare Public Bug Bounty

44disclosed reports
$36,675paid in bounties
24,294known subdomains

See its reports on the map

Attack surface: 24,294 known subdomains

cloudflareac…nscloudflarewo…cdnsecondaryrealtimeresearchteamslabs-staginglabsstagingmcpspeedwwwfedampregistraragentsdevelopersaimdapaidashradarregionpat-issueripfsnel

24,294subdomains across 3 root domains

All subdomainsLoading…
    Download all 24,294

    Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

    What gets reported to Cloudflare Public Bug Bounty

    Most upvoted reports

    AllValidInformativeN/ADuplicate

    1. Any WARP User Can Access Organization-Specific ApplicationInformativeImproper Authentication - Generic
      46 votes
    2. Basic XSS [WAF Bypasses]InformativeCross-site Scripting (XSS) - Generic
      $5027 votes
    3. YAML schema injection risk in Swagger UI via schema_url parameter at developers.cloudflare.comInformativeResource Injection · low
      24 votes