GitLab · disclosed reports
Information Disclosure
32 disclosed reports · $26,300 paid · 27 valid · 2 informative · 1 duplicate · 1 N/A · 1 not checked yet
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open GitLab on HackerOne- reports
- 32
- valid
- 27
- paid a bounty
- 5
Every one of the 32 is a mark on the map. Named now: 27 to 32, most upvoted first.
- Labels created in private projects are leaked
- GFM renderer leaks external issue tracker URL of private project
- Project Milestones Disclosed Via Groups When the Victim disabled milestones access in project settings
- Guests Will Disclose the Private Project Full Activity Via Project Activity Feeds
- Confidential issues leaked in public projects when attached to milestone
- Use of Ruby Forwardable module and runtime meta-programming may introduce vulnerabilities
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP