Stripo Inc · disclosed reports
Access Control
12 disclosed reports · $0 paid · 12 valid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Stripo Inc on HackerOne- reports
- 12
- valid
- 12
- paid a bounty
- 0
Every one of the 12 is a mark on the map. Named now: 1 to 12, most upvoted first.
- Open memory dump method leaking customer information ,secret keys , password , source code & admin accounts
- [Critical] Unauthorized Cross-Tenant Data Access in Stripo AI Hub Campaign via Deleted Project.
- [www.stripo.email] There is no rate limit for contact-us endpoints
- subdomain takeover at status0.stripo.email
- [www.stripo.email] You can override the speed limit by adding the X-Forwarded-For header.
- Upload Profile Photo in any folder you want with any extension you want
- Improper Authorization
- subdomain takeover at status-stage0.stripo.email
- Cross-Site WebSocket Hijacking Lead to Steal XSRF-TOKEN
- multiple email usage -my.stripo.email-
- Email verification bypasa
- Able to download any hosted content on AWS S3 bucket(stripo)
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP