HackerOne · disclosed reports
Input Validation and Logic
35 disclosed reports · $6,500 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open HackerOne on HackerOne- reports
- 35
- paid a bounty
- 8
Every one of the 35 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Hackerone is not properly deleting user id
- Getting New Invitations without Leaving Programs
- adding h1_analyst_* to username for normal users
- Client-Side Race Condition using Marketo, allows sending user to data-protocol in Safari when form without onSuccess is submitted on www.hackerone.com
- Bypassing HackerOne 2FA due to race condition
- Any user could upload attachments to pentest scoping form they don't have access to
- Account recovery text message is sending a wrong domain to users.
- @wearehackerone.com is vulnerable to namespace attacks due to hackerone.com not being RFC2142 compliant.
- Harvesting all private invites using leave program fast-tracked invitation and security@ email forwarding feature
- Cloud Computer Hackerone Triager can be Accessible for everyone [h1_analyst_lucas+view@wearehackerone.com] computer
- Improper UUID validation results in bypass of #419896
- Asset Inventory Internal Descriptions are leaked in CSV export
- Residual Malicious Payloads on HackerOne after Vulnerability Fixes
- Minor security issue with Hackerone Invitations from sandbox program
- Email Forwarding invitations for Drafts are not marked as accepted, allowing multiple users to join a program after disabling Email Forwarding
- Program managers can see draft reports using Export Reports feature
- Response program can display "eligible for bounty" in scope area in program policy
- Response program can create bounty table
- Adding or removing a new non-preferred payout method does not trigger an e-mail or account notification
- API Last Request Date/Time Not Updating
- Ability to invite a new member on Sandbox Program
- Business Logic error leads to bypass 2FA requirement
- User's who are banned from program can still be invited to the new reports as collaborators
- Changing Victim's JIRA Integration Settings Through Multiple Bugs
- [Bypass] Ability to invite a new member in sandbox Organization
- Lack warning label when receiving a letter
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.