HackerOne · disclosed reports
Misconfiguration and Insecure Design
13 disclosed reports · $2,500 paid · 13 valid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open HackerOne on HackerOne- reports
- 13
- valid
- 13
- paid a bounty
- 5
Every one of the 13 is a mark on the map. Named now: 1 to 13, most upvoted first.
- Recently added 'Country' field doesn't send email notification when changed
- Password not checked when disabling 2FA on HackerOne
- Domain highlighting on External link warning is not working on Chrome & Microsoft Edge browsers on Mobile
- 2M Reports on HackerOne Celebration! - Ability to bulk-submit many reports.
- Google Analytics could be used as CSP bypass for data exfiltration on hackerone.com
- Private program email forwarding response invitation not expire after first use.
- Ability to bulk submit reports via query named based batching
- Common response suggestion is sent to Google Analytics when user accepts duplicate comment Genius suggestion
- HackerOne Integrations Design Issue
- Updating payout preference to CurrencyCloud doesn't notify user via email
- CSRF at [Apply to this program] that lead to submit your request automatic with out any validations
- Report redaction doesn't apply to report title update activities
- HTML injection can lead to data theft
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.