HackerOne · disclosed reports
Misconfiguration and Insecure Design
15 disclosed reports · $16,750 paid · 15 valid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open HackerOne on HackerOne- reports
- 15
- valid
- 15
- paid a bounty
- 3
Every one of the 15 is a mark on the map. Named now: 1 to 15, most upvoted first.
- Internal Access to Hackerone confluence Docs
- Indexing of urls on the "External link warning" pages discloses many vulnerable endpoints from the past and unlisted videos/photos
- Account creation with invalid email addresses / email is accepting % and %0d%0a line termination chars
- Hacker.One Subdomain Takeover
- Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONP
- Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?)
- Homograph fix Bypass
- Parameter pollution in social sharing buttons
- Invalid Host detection at https://hackerone.com/redirect
- Register & create a ticket as somebody else on HackerOne Support
- Missing SPF for hackerone.com
- Content Security Policy not applied to error pages at multiple HackerOne endpoints
- Email spoofing
- www.hackerone.com website CSP "script-src" includes "unsafe-inline"
- Example HackerOne security@ forward domain is not registered
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.