HackerOne · disclosed reports
Misconfiguration and Insecure Design
92 disclosed reports · $24,600 paid · 76 valid · 12 informative · 2 duplicate · 2 N/A
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open HackerOne on HackerOne- reports
- 92
- valid
- 76
- paid a bounty
- 20
Every one of the 92 is a mark on the map. Named now: 27 to 52, most upvoted first.
- 2fa can't be activated on app.pullrequest.com
- Introspection query leaks sensitive graphql system information.
- HTML injection can lead to data theft
- Homograph attack in escalate report
- Enumeration of users
- www.hackerone.com website CSP "script-src" includes "unsafe-inline"
- Example HackerOne security@ forward domain is not registered
- Previous attachments can be referenced when creating a new report
- Homograph attack
- Enumerating HackerOne Pentests
- Password Reset Bug
- Able to remove the admin access of my program
- Session not invalidated after password reset
- Logical issues with account settings
- Race Conditions Exist When Accepting Invitations
- Gain reputation by creating a duplicate of an existing report
- Control Characters Not Stripped From Username on Signup
- javascript: and mailto: links are allowed in JIRA integration settings
- Manipulate report timeline activity by using null byte.
- Improve signals in reputation
- homograph attack. IDNs displayed in unicode in bug reports and on external link warning page
- All Active user sessions should be deleted when user change his password!
- Privilege escalation..., or not?!
- RTL override symbol not stripped from file names
- While adding a payment method - Notification email not sent to newly added email ID as well as there is no verification for new email id (Paypal)
- Missing Password Confirmation at a Critical Function (Payout Method)
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.