HackerOne · disclosed reports
Information Disclosure
44 disclosed reports · $66,150 paid · 44 valid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open HackerOne on HackerOne- reports
- 44
- valid
- 44
- paid a bounty
- 19
Every one of the 44 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Customer private program can disclose email any users through invited via username
- An attacker can can view any hacker email via /SaveCollaboratorsMutation operation name
- Partial disclosure of report activity through new "Export as .zip" feature
- Information Disclosure in /skills call
- Internal attachments can be exported via "Export as .zip" feature
- Manipulate hacker profile and private program hacktivity to expose your name as researchers who is actively submitting reports with resolve status
- An invite-only's program submission state is accessible to users no longer part of the program
- Discrepancy in hacker profile report count may reveal existence of a private program by publishing a report
- Disclose any user's private email through API
- Searching from Hacktivity returns hits for words in limited disclosure reports that are not visible
- Leaked H1's Employees Email addresses,meeting info on private bug bounty program ████████
- Internal Gitlab Ticket Disclosure via External Slack Channels
- Emails of invited collaborators are disclosed in full in payload for report participants
- Creation of bounties through Customer API leads to private email disclosure
- Reading redacted data via hackbot's answers
- Some limited confidential information can still be accessed after a user exits a private program
- Draft report exposure via slack alerting system for programs
- Possible PII Disclosure via Advanced Vetting Process - ██████
- Private information exposed through GraphQL filters
- [Spot Check] - Ability to disclose metadata about Spot Checks (Number of Hackers + Hackers Criteria) via "SpotCheckSingleQuery"
- inviting collaborator using email disclose the hackerone account related to the user
- latest_activity_id and latest_activity_at may disclose information about internal activities to unauthorized users
- Any organization's assets pending review can be downloaded
- Usernames still visible on report export pdf despite "I want to redact all usernames" is selected
- Validation message in Bounty award endpoint can be used to determine program balances
- Inline banner on Report page discloses whether organization runs a private program
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.