HackerOne · disclosed reports
Information Disclosure
156 disclosed reports · $98,650 paid · 131 valid · 16 informative · 8 duplicate · 1 N/A
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open HackerOne on HackerOne- reports
- 156
- valid
- 131
- paid a bounty
- 46
Every one of the 156 is a mark on the map. Named now: 131 to 156, most upvoted first.
- Search query text, including from potentially undisclosed reports, sent to Google Analytics on Inbox query page
- Information disclosure via policy update notifications after removal from program
- Disclosure of external users invited to a specific report
- "early preview" programs disclosure
- Information disclosure
- Leakage badges on disabled user
- Private Program all members disclosed
- Information leakage - Private reports cached by Google
- Ability to see common response titles of other teams (limited)
- Report title autocompletion
- Deleted name still present via mouseover functionality for user accounts
- Partial disclosure of undisclosed programs through <meta> tags
- Information Disclosure which violate program privacy
- Private Program Disclosure in /:handle/settings/allow_report_submission.json endpoint
- Minimum bounty of a private program is visible for users that were removed from the program
- Minor Bug: Public un-compiled CSS with original sass, versioning, source map, comments, etc.
- Reputation gain split by company can be used to track the existence of otherwise undisclosed reports
- Disclosure of private programs that have an "external" page on HackerOne
- Email Address Leak
- Distinguish EP+Private vs Private programs in HackerOne
- HackerOne Private Programs users disclosure and de-anonymous-ize
- Number of invited researchers disclosed as part of JSON search response
- Internal bounty and swag details disclosed as part of JSON response
- Pending member invitations are not revoked on program name change
- Requesting unknown file type returns Ruby object w/ address
- Notification of previous signed out user leakage.
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.