HackerOne · disclosed reports
Information Disclosure
131 disclosed reports · $98,650 paid · 131 valid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open HackerOne on HackerOne- reports
- 131
- valid
- 131
- paid a bounty
- 46
Every one of the 131 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Confidential data of users and limited metadata of programs and reports accessible via GraphQL
- The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is present
- Customer private program can disclose email any users through invited via username
- An attacker can can view any hacker email via /SaveCollaboratorsMutation operation name
- Partial disclosure of report activity through new "Export as .zip" feature
- Information Disclosure in /skills call
- Internal attachments can be exported via "Export as .zip" feature
- Public GitHub repositories for multiple HackerOne managed triage team profiles contain private HackerOne reports information
- Google Docs link in JS files allows editing & reading survey information
- Manipulate hacker profile and private program hacktivity to expose your name as researchers who is actively submitting reports with resolve status
- An invite-only's program submission state is accessible to users no longer part of the program
- Unauthorized access to metadata of undisclosed reports that were retested
- Disclosure of `payment_transactions` for programs via GraphQL query
- 404-response contains debug-information with all headers
- Total Paid Bounty Paid can be disclose
- Discrepancy in hacker profile report count may reveal existence of a private program by publishing a report
- Team object in GraphQL disclosed private_comment
- Unauthorized user can obtain `report_sources` attribute through Team GraphQL object
- Disclose any user's private email through API
- Private program disclosure via `vpn_suspended` GraphQL query
- Searching from Hacktivity returns hits for words in limited disclosure reports that are not visible
- Leaked H1's Employees Email addresses,meeting info on private bug bounty program ████████
- Internal Gitlab Ticket Disclosure via External Slack Channels
- Emails of invited collaborators are disclosed in full in payload for report participants
- GraphQL field on Team node can be used to determine if External Program runs invite-only program
- Creation of bounties through Customer API leads to private email disclosure
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.