Bug bounty program · HackerOne
Most upvoted reports11
- #3085742ValidIDOR on in-app hardcoded zombie endpointBykea · Insecure Direct Object Reference · 2025 · Medium–128votes
- #2374730ValidBroken Access Control (IDOR) in Booking Detail and Bids Could Leads to Sensitive Information DisclosureBykea · Insecure Direct Object Reference · 2025 · High–108votes
- #3228011ValidCritical Information Disclosure via /talos/api/v1/files/uploadBykea · Information Disclosure · 2025 · Critical–97votes
- #2867022ValidImproper Access Control Allows Trip Hijacking and Passenger/Driver PII DisclosureBykea · Insecure Direct Object Reference · 2025 · Medium–80votes
- #2861888ValidAbility to increase any customer offered fare (BAC)Bykea · Insecure Direct Object Reference · 2025 · Medium–76votes
- #2209750ValidExposed trip_no in WebSocket Responses Leading to Excessive information DisclosureBykea · Access Control · 2025 · Medium–64votes
- #2868164ValidBypassing Bronze Partner Wallet Restriction to Accept Trips with Negative BalanceBykea · Input Validation and Logic · 2025 · Medium–63votes
- #2894018ValidLack of Feedback Validation Permits Arbitrary Driver RatingsBykea · Insecure Direct Object Reference · 2025 · Medium–60votes
- #3328343ValidLack of minimum value bid wheel verification on customer_bid in Rental TripsBykea · Input Validation and Logic · 2025 · Low–55votes
- #3295503ValidCustomer can cancel a individual booking in a batch, causing locking of partner.Bykea · Input Validation and Logic · 2025 · Medium · a user account (title)–49votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.