HackerOne · disclosed reports
Information Disclosure
156 disclosed reports · $98,650 paid · 131 valid · 16 informative · 8 duplicate · 1 N/A
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open HackerOne on HackerOne- reports
- 156
- valid
- 131
- paid a bounty
- 46
Every one of the 156 is a mark on the map. Named now: 105 to 130, most upvoted first.
- Hackerone Email Addresses Enumeration
- People who interviewed for HackerOne security analyst position can be enumerated and their personal email address may be exposed
- Know undisclosed Bounty Amount when Bounty Statistics are enabled.
- program_analytics_benchmarks query shows information not visible in public
- Users querying dim_hacker_reports table through Analytics API can determine data from dim_reports table using WHERE or HAVING query
- Used email confirmation link reveals the email address which is tied to it
- Names not completely redacted despite "Redact the names of the involved users" is selected
- Exposing hackerone users personally identifiable information by abusing sandbox with swag reward enabled
- Invalid Phabricator API token revealed through error message when escalating a report
- Know whether private program for company exist or not
- Private partial disclosure of h1 infrastructure
- File Name Enumeration
- PII data Leakage through hackerone reports
- Improper data update process on UpdatePhabricatorIntegration mutation leads to leak of Phabricator Conduit API token.
- Hackers can reveal the names of private programs that have an external link
- Invited team member can disclosure slack channels
- Submitted reports state logs leakage
- Users contents on AWS is cacheable
- Old titles are not hidden in reports with limited disclosure
- Lack of cross-origin request blocking allows leaking of sensitive information on several endpoints
- Researcher gets email updates on a private program after he/she quits that program.
- Obtain the username & the uid of the one doing the S3 sync on Hackerone
- CSS leaks SCSS debug info
- Verbose PHP error messages exposed on a blog article
- No email verification on username change
- Reward Money Leakage
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.