HackerOne · disclosed reports
Misconfiguration and Insecure Design
92 disclosed reports · $24,600 paid · 76 valid · 12 informative · 2 duplicate · 2 N/A
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open HackerOne on HackerOne- reports
- 92
- valid
- 76
- paid a bounty
- 20
Every one of the 92 is a mark on the map. Named now: 79 to 92, most upvoted first.
- Issue with remember_user_token
- Issue with password change in Disabled Account
- Sending emails (via HackerOne) impersonating other users
- Edit Auto Response Messages
- Logic error with notifications: user that has left team continues to receive notifications and can not 'clean' this area on account
- Content Spoofing via reports
- Arbitrary file uploads to Amazon WS.
- SECURITY: Referencing previous Reports attachment_IDs on new Reports via Draft_Sync DELETES Attachments
- Abusing HOF rankings in limited circumstances
- User with Read-Only permissions can request/approve public disclosure
- Weak HSTS age in support hackerone site
- Redirection Page throwing error instead of redirecting to site
- Fake URL + Additional vectors for homograph attack
- User with Read-Only permissions can manually public disclosure the report
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.