HackerOne · disclosed reports
Information Disclosure
156 disclosed reports · $98,650 paid · 131 valid · 16 informative · 8 duplicate · 1 N/A
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open HackerOne on HackerOne- reports
- 156
- valid
- 131
- paid a bounty
- 46
Every one of the 156 is a mark on the map. Named now: 79 to 104, most upvoted first.
- Report invitation links not restricted to any existing user
- Two-factor authentication bypass lead to information disclosure about the program and all hackers participate
- Invitation token leaks to https://bat.bing.com
- Information leakage of private program
- Program Email Nofication settings ignored when being added as an external contributor
- Timing attack towards endpoints on the web without CSRF
- Private information exposed through GraphQL search endpoints aggregates
- Hackers can reveal the names of private programs that have an external link and Enterprise Product Edition
- Attacker can claim credentials for private program that has a published external program
- Internal usage of AdBlockPlus may expose PoC URLs to unknown third-parties
- View Any Program's Team Members through GET https://hackerone.com/invitations/
- Invitation tokens leak to Google Analytics
- Information disclosure - Feedback is accessible on Public profile even after 'disallowed' at https://hackerone.com/settings/feedback
- A small set of users were assigned someone else's payout preference
- Disclosure of h1 challenges name through the calendar
- Program profile metrics endpoint contains mean time to triage, even when turned off
- Private invitation links/tokens leak to third-party analytics site
- Can read features from any user
- Program profile_metrics.json contains time to triage for deptofdefense even it's turned off
- Able To Check The Exact Bounty Balance of any Bug Bounty Program
- Information Disclosure when /invitations/<token>.json is not yet accepted
- resolved bugs in a program are public despite the program settings
- report id is exposed for undisclosed reports in Hacktivity
- User object in GraphQL exposes number of trial reports for External Programs that also have a Private Program
- Transitioning a Private Program to Public Does Not Clear Previously Private Updates to Hackers
- Ability to enumerate private programs using SAML
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.