Bug bounty program · HackerOne
Most upvoted reports12
- #98247Validlogin to any user's cashier account and full account information disclosureDeriv.com · Authentication · 2015–27votes
- #297198ValidLeaking Referrer in Reset Password LinkDeriv.com · Misconfiguration and Insecure Design · 2018$5014votes
- #95981ValidHttp Response Splitting - Validate linkDeriv.com · No weakness recorded · 2015$7511votes
- #98469ValidEmail Verification Link can be Used as Password Reset Link!Deriv.com · Authentication · 2015–7votes
- #95599ValidCross Site ScriptingDeriv.com · Cross-site Scripting · 2015–5votes
- #97609InformativeUser Enumeration : Due to rate limiting on registrationDeriv.com · Information Disclosure · 2015–5votes
- #140392ValidCJ vulnerability in subdomainDeriv.com · Misconfiguration and Insecure Design · 2016–5votes
- #101983ValidCookie bugDeriv.com · Authentication · 2015–4votes
- #112306ValidFull takeover of some binary.com sub domainsDeriv.com · No weakness recorded · 2016–4votes
- #158757ValidCross site scriptingDeriv.com · Cross-site Scripting · 2016$754votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.