Bug bounty program · HackerOne
Most upvoted reports10
- #3115705ValidStored XSS in File Upload Leads to Privilege Escalation and Full Workspace TakeoverDust · Cross-site Scripting · 2025 · High–118votes
- #3114554ValidPrivilege Persistence via Cloned AgentDust · Access Control · 2025 · Medium–91votes
- #3103755ValidPrivilege Escalation in Edit and Create Secret Endpoints Leads to Unauthorized Secret ModificationDust · Access Control · 2025 · High–86votes
- #3104355ValidRace Condition in Folder Creation Allows Bypassing Folder LimitDust · Input Validation and Logic · 2025 · Medium–65votes
- #3112106ValidBAC – Bypass chatbot restrictions via unauthorized mention injectionDust · No weakness recorded · 2025 · Medium–65votes
- #3103849InformativePrivilege Escalation leads to Unauthorized Access to Private Conversations By any Regular user [Read , Edit and Delete]Dust · Access Control · 2025 · Critical · a user account (title)–62votes
- #3101986ValidUI flaw allows unauthorized users to add documents to restricted foldersDust · Access Control · 2025 · Medium–57votes
- #3101207ValidImproper Session Invalidation – Auto Sign-In Without Credentials After Logout (Affects Chrome & Firefox)Dust · Authentication · 2025 · Medium · no account (title)–56votes
- #3101858ValidUnauthorized Table Creation by MemberDust · Access Control · 2025 · Medium–52votes
- #3102890ValidUser Limit Bypass via Pending Invitations in Workspace SystemDust · Input Validation and Logic · 2025 · Medium–51votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.