HackerOne · disclosed reports
Information Disclosure
156 disclosed reports · $98,650 paid · 131 valid · 16 informative · 8 duplicate · 1 N/A
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open HackerOne on HackerOne- reports
- 156
- valid
- 131
- paid a bounty
- 46
Every one of the 156 is a mark on the map. Named now: 53 to 78, most upvoted first.
- Partial report contents leakage - via HTTP/2 concurrent stream handling
- Program metrics disclosed response_efficiency_percentage via /program_name json response despite the team decided not to show on their profile
- Disclosure of Email title report in quick award paypout email (no content mode)
- View any user email using the Team's audit log section
- TeamProfile exposes partially sensitive information through GraphQL
- HackerOne customer submitted sensitive link to VirusTotal, exposing confidential information
- Team object exposes amount of participants in a private program to non-invited users
- Report Private Links Leaks to Google Analytics via Query String Param
- Private program name disclosure in the invitation mail for another program
- HackerOne Staging uses Production data for testing
- Private program policy page still accessible after user left the program
- New Search Feature: Search for non-public words in limited disclosure reports
- Hacker email disclosed on submission at hackerone hactivity
- Extra program metrics disclosed via /PROGRAM_NAME json response
- Total bounties paid amount is disclosed because of redesign of the Program Profiles
- Attachment in published HackerOne report exposure private program
- information disclosure of another company bug on video.
- Report Duplicate Detector can match deleted and draft reports, may disclose title and vulnerability information
- Disclosure of the name of a program that has a private part with an external link
- ImageMagick GIF coder vulnerability leading to memory disclosure
- Hackers two email disclosed on submission at hackerone hactivity
- GraphQL node interface for ActiveResource models lacks encoding for resource identifier, enabling parameter injection in Payments backend
- Disclosure of top 10 vulnerability types for programs that haven't enabled the Insights feature
- Report Bulk endpoint "agree-on-going-public" action may reveal Report disclosure state for invite-only programs
- Disclosure of Program email Title Report when being removed as contributor. Bypass for Report #645264
- Team object in GraphQL that have a published external program may expose existence of a private program
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.