HackerOne · disclosed reports
Information Disclosure
156 disclosed reports · $98,650 paid · 131 valid · 16 informative · 8 duplicate · 1 N/A
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open HackerOne on HackerOne- reports
- 156
- valid
- 131
- paid a bounty
- 46
Every one of the 156 is a mark on the map. Named now: 27 to 52, most upvoted first.
- New Hacktivity features:Bounty rewards leakage Where programs doesn’t decide to disclose bounty in limited disclosure report
- Team object in GraphQL disclosed total number of whitelisted hackers
- Reading redacted data via hackbot's answers
- Some limited confidential information can still be accessed after a user exits a private program
- "Bounties paid in the last 90 days" discloses the undisclosed bounty amount in program statistics
- Draft report exposure via slack alerting system for programs
- Possible PII Disclosure via Advanced Vetting Process - ██████
- Private information exposed through GraphQL filters
- [Spot Check] - Ability to disclose metadata about Spot Checks (Number of Hackers + Hackers Criteria) via "SpotCheckSingleQuery"
- inviting collaborator using email disclose the hackerone account related to the user
- latest_activity_id and latest_activity_at may disclose information about internal activities to unauthorized users
- HackerOne Undisclosed Report Leak via PoC of Full Disclosure on Hacktivity
- Any organization's assets pending review can be downloaded
- Usernames still visible on report export pdf despite "I want to redact all usernames" is selected
- Team object in GraphQL discloses team group names and permissions
- A HackerOne employee's GitHub personal access token exposed in Travis CI build logs
- Pentester can obtain information about other pentesters who applied for the same test, but weren't accepted
- Validation message in Bounty award endpoint can be used to determine program balances
- Being able to disclose IBB bounty table of any public program
- Making program preference -> program visibilty feature usless and disclosing API Identifier in the progress and data that may cause potential IDORS.
- The request tells the number of private programs, the new system of authorization /invite/token
- Private data related to program exposed via /reports/<id>.json endpoint to external user participant
- Inline banner on Report page discloses whether organization runs a private program
- Private draft report exposure in a program a user is added as a viewer to
- Attachment object in GraphQL continues to grant access to files, even if they are removed from rendering
- Hackers can find out the ID of private programs
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.