Bug bounty program · HackerOne
Most upvoted reports12
- #2801036ValidAvailability Impact from Exploiting Project Name VulnerabilitiesDoppler · Input Validation and Logic · 2024 · Low$25071votes
- #2418210ValidAcquisition on broken link listed on the page "https://docs.doppler.com/docs/removal-deprecated-packages-scripts in [scheduling a call]Doppler · Server-Side Request Forgery · 2024 · Low–49votes
- #1073726No longer publicStored XSS in [https://dashboard.doppler.com/workplace/*/logs] pagesDoppler · Cross-site Scripting–42votes
- #2921905InformativeWAF bypass and java script incomplete handling of Unicode characters might leads to dom-xssDoppler · Access Control · 2025–36votes
- #2399386ValidGithub app(link) Takeover Listed on "https://docs.doppler.com/docs/github-actions" pageDoppler · No weakness recorded · 2024–32votes
- #1071660No longer publicNo rate limit into email change leads to email notification boombing to its victim.Doppler · Access Control–8votes
- #1071521No longer publicemail spoofing on doppler.teamDoppler · Misconfiguration and Insecure Design–7votes
- #1072635No longer publicOwner can change themself for another Role Mode but application doesnot have this function.Doppler · Access Control–6votes
- #1073734No longer publicUser Access Control in Community PlanDoppler · Access Control–3votes
- #1074196No longer publicBypass Email Verification.Doppler · Access Control–3votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.