Starbucks · disclosed reports
Access Control
18 disclosed reports · $0 paid
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Starbucks on HackerOne- reports
- 18
- paid a bounty
- 0
Every one of the 18 is a mark on the map. Named now: 1 to 18, most upvoted first.
- Subdomain takeover of datacafe-cert.starbucks.com
- Unrestricted File Upload Leads to RCE on mobile.starbucks.com.sg
- Bug in GraphQL and API integration leads to limited user address disclosure
- Subdomain takeover of d02-1-ag.productioncontroller.starbucks.com
- Subdomain takeover on svcgatewayus.starbucks.com
- Subdomain takeover on happymondays.starbucks.com due to non-used AWS S3 DNS record
- Thailand - a small number of SMB CCTV footage backup servers were accessible without authentication.
- Subdomain takeover on wfmnarptpc.starbucks.com
- Multiple Subdomain takeovers via unclaimed instances
- China - president-starbucks.com.cn DNS configuration reported as takeover
- Subdomain takeover on developer.openapi.starbucks.com
- China - ecjobsdc.starbucks.com.cn html/shtml file upload vulnerability
- svcardproxydevus.starbucks.com Subdomain take over
- Subdomain takeover on svcgatewaydevus.starbucks.com and svcgatewayloadus.starbucks.com
- Bulgaria - Subdomain takeover of mail.starbucks.bg
- unuse domain still in using at wechat by Starbucks East China
- Sidekiq web UI (Ruby background processing) accessible unauthenticated via https://gift-test.starbucks.co.jp/sidekiq/busy
- Thailand - SNMP Publicly Accessible
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.