Skip to content
BackEsc
Sign in

X / xAI · disclosed reports

Information Disclosure

30 disclosed reports · $15,710 paid

Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.

Open X / xAI on HackerOne
reports
30
paid a bounty
18

Every one of the 30 is a mark on the map. Named now: 1 to 26, most upvoted first.

  1. Twitter ID exposure via error-based side-channel attack#505424X / xAI · $1,470 · 154 votes
  2. Vine all registered user Private/sensitive information disclosure .[ Ip address/phone no/email and many other informations ]#202823X / xAI · 121 votes
  3. Changing email address on Twitter for Android unsets "Protect your Tweets"#472013X / xAI · $2,940 · 119 votes
  4. Cross-Domain Leakage of X Username / UserID due to Dynamically Generated JS File#2244229X / xAI · $1,500 · 115 votes
  5. Incorrect details on OAuth permissions screen allows DMs to be read without permission#434763X / xAI · $2,940 · 80 votes
  6. Protected tweets exposure through the URL#491473X / xAI · $560 · 67 votes
  7. Tracking of users on third-party websites using the Twitter cookie, due to a flaw in authenticating image requests#329957X / xAI · $1,120 · 49 votes
  8. View liked twits of private account via publish.twitter.com#174721X / xAI · 47 votes
  9. Listing of Amazon S3 Bucket accessible to any amazon authenticated user (metrics.pscp.tv)#278191X / xAI · $140 · 36 votes
  10. [staging-engineering.gnip.com] Publicly accessible GIT directory#218465X / xAI · $280 · 33 votes
  11. Identify the mobile number of a twitter user#1225164X / xAI · $560 · 30 votes
  12. HTTP 401 response injection on "amp.twimg.com/amplify-web-player/prod/source.html" through "image_src" parameter#221328X / xAI · 30 votes
  13. The Deleted Polls is Still Accessable after 30 Days#1015373X / xAI · $560 · 28 votes
  14. [sms-be-vip.twitter.com] vulnerable to Jetleak#143935X / xAI · $1,260 · 28 votes
  15. Twitter Media Studio Source Information Disclosure With Analyst Role#961757X / xAI · 27 votes
  16. Information Exposure Through Directory Listing vulnerability on 8 vcache**.usw2.snappytv.com websites#438299X / xAI · 27 votes
  17. Information Disclosure through .DS_Store in ██████████#142549X / xAI · $560 · 27 votes
  18. CVE-2017-15277 on Profile page#315906X / xAI · 23 votes
  19. Twitter for android is exposing user's location to any installed android app#185862X / xAI · $560 · 23 votes
  20. Unauthorized Access to Protected Tweets via niche.co API#273698X / xAI · 22 votes
  21. ms5 debug page exposing internal info (internal IPs, headers)#311326X / xAI · $280 · 19 votes
  22. Sensitive Information Disclosure https://cards-dev.twitter.com#268888X / xAI · $280 · 19 votes
  23. leaking Digits OAuth authorization to third party websites#166942X / xAI · 13 votes
  24. Access MoPub Reports Data even after Company removed you from their MoPub Account.#399174X / xAI · 11 votes
  25. Reports Modal in app.mopub.com Disclose by any user#574639X / xAI · $280 · 9 votes
  26. Profile Pic padding (Length-hiding) fails due to use of GZIP#29835X / xAI · $280 · 7 votes

paid a bounty

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in