Browse / Reddit

Reddit

See its reports on the map

Attack surface: 23,159 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Reddit

• Access Control14
• Authentication13
• Cross-site Scripting10
• Insecure Direct Object Reference6
• Business Logic5
• Information Disclosure4

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Infromation Disclosure To Use of Hard-coded Cryptographic KeyDuplicateUse of Hard-coded Cryptographic Key · medium
   238 votes
2. Oauth Misconfiguration Lead To Account TakeoverDuplicateImproper Authorization · medium
   21 votes
3. Missing rate limit in current password change settings leads to Account takeoverDuplicateImproper Restriction of Authentication Attempts · medium
   13 votes
4. No rate limit leads to spaming postDuplicateImproper Authentication - Generic · medium
   11 votes
5. Rate limit is implemented in Reddit , but its not working . DuplicateImproper Authentication - Generic · low
   9 votes
6. User Account has been taken outDuplicateWeak Cryptography for Passwords · critical
   9 votes
7. Huge amount of Subdomains Takeovers at Reddit.comDuplicateImproper Access Control - Generic · medium
   8 votes
8. No Rate limit on change password leads to account takeoverDuplicateImproper Restriction of Authentication Attempts · low
   8 votes
9. com.reddit.frontpage vulernable to Task Hijacking (aka StrandHogg Attack)DuplicatePhishing · medium
   2 votes
10. No Password Length Restriction leads to Denial of ServiceDuplicateUncontrolled Resource Consumption
    2 votes