HackerOne · disclosed reports
Input Validation and Logic
35 disclosed reports · $6,500 paid · 31 valid · 3 informative · 1 duplicate
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open HackerOne on HackerOne- reports
- 35
- valid
- 31
- paid a bounty
- 8
Every one of the 35 is a mark on the map. Named now: 27 to 35, most upvoted first.
- A team member of the program with Report rights can ban the Admin
- Dangling cloud instance at vpn.inverselink.com
- Hacker can bypass minimum bounty amount restrictions in "invitation preferences" setting via UpdateInvitationPreferencesMutation GraphQL operation
- Submitting report through Embedded Submission form gives user indefinite access to a profile
- 2FA requirement bypass when claiming bounty
- Rounding errors on rewarding a bounty leads to bypassing the 20% H1 commission fee
- Temporary banned user (from platform) is able to make submissions via embedded submission forms
- GitHub users outside of HackerOne organization can create and update Wiki pages of certain public HackerOne repositories
- Mismatch between frontend and backend validation via `ban_researcher` leads to H1 support and hackers email spam
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.