# Opera Public Bug Bounty: bug bounty program on Bugcrowd

> Opera Public Bug Bounty is a bug bounty program on Bugcrowd. Bounties range from $50 to $5,000. 89 assets are listed in scope, 89 of them bounty-eligible.

- **Company:** Opera Public Bug Bounty
- **Platform:** Bugcrowd
- **Program page:** /engagements/opera
- **Pays bounties:** yes
- **Submissions:** open
- **Bounty range:** $50 to $5,000
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/opera

## Scope

As imported from Bugcrowd on November 7, 2026: 89 assets in scope (89 bounty-eligible), 22 out of scope. The policy page is the authority.

- `*.adx.opera.com` (api): in scope, bounty-eligible
- `*.apex-football.com` (website): in scope, bounty-eligible
- `*.apexnews.com` (api): in scope, bounty-eligible
- `*.apexscores.io` (api): in scope, bounty-eligible
- `*.dailyadvent.com` (website): in scope, bounty-eligible
- `*.feednews.com` (api): in scope, bounty-eligible
- `*.opera-mini.net` (api): in scope, bounty-eligible
- `*.opera.com` (website): in scope, bounty-eligible
- `*.opera.news` (api): in scope, bounty-eligible
- `*.opera.software` (other): in scope, bounty-eligible
- `*.opera.technology` (api): in scope, bounty-eligible
- `*.operafootball.com` (website): in scope, bounty-eligible
- `*.operanewsapp.com` (api): in scope, bounty-eligible
- `*.opr.news` (api): in scope, bounty-eligible
- `*.osite99.com` (api): in scope, bounty-eligible
- `*.osp.opera.software` (api): in scope, bounty-eligible
- `*.rtbscale.com` (api): in scope, bounty-eligible
- `*.savi.xyz` (api): in scope, bounty-eligible
- `*.sec-tunnel.com` (api): in scope, bounty-eligible
- `*.yoyogames.com` (api): in scope, bounty-eligible
- `102.23.96.0/22` (api): in scope, bounty-eligible
- `103.83.120.0/22` (api): in scope, bounty-eligible
- `107.167.96.0/19` (api): in scope, bounty-eligible
- `141.0.8.0/21` (api): in scope, bounty-eligible
- `185.26.180.0/22` (api): in scope, bounty-eligible
- `195.189.143.0/24` (api): in scope, bounty-eligible
- `203.89.100.0/22` (api): in scope, bounty-eligible
- `37.228.104.0/21` (api): in scope, bounty-eligible
- `77.111.244.0/22` (api): in scope, bounty-eligible
- `82.145.208.0/20` (api): in scope, bounty-eligible
- `91.203.96.0/22` (api): in scope, bounty-eligible
- `accounts.opera.com` (api): in scope, bounty-eligible
- `Apex Football` (android): in scope, bounty-eligible
- `api.gx.games/dc` (api): in scope, bounty-eligible
- `api.gx.games/dev` (api): in scope, bounty-eligible
- `api.gx.games/gms` (api): in scope, bounty-eligible
- `api.gx.games/gx` (api): in scope, bounty-eligible
- `api.gx.games/gxc` (api): in scope, bounty-eligible
- `api.gx.games/profile` (api): in scope, bounty-eligible
- `api.gx.games/pub` (api): in scope, bounty-eligible
- and 71 more on the BugRater page

## Recent public accepted findings

- November 3, 2026: high severity on *.feednews.com
- October 30, 2026: unrated severity on Opera for Android
- October 30, 2026: critical severity on Opera PC
- October 29, 2026: low severity on Opera GX for Android
- October 26, 2026: low severity on Opera for Android

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.