Browse / Omise

Omise

See its reports on the map

Attack surface: 182 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Omise

• Access Control8
• Information Disclosure6
• Authentication4
• Server-Side Request Forgery3
• Open Redirect3
• Cross-site Scripting2

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Public and secret api key leaked via omise github repo(owned by omise)InformativeInformation Disclosure
   6 votes
2. Authenticity token doesnt expire after single use leading to CSRFInformativeCross-Site Request Forgery (CSRF)
   3 votes