Skip to content
Sign in

Bug bounty program

FL

Flickr

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
5
Disclosed reports
16
Subdomains
255

Most upvoted reports16

All reports
Most upvoted reports of Flickr
ReportWeaknessDisclosedBountyVotes
Flickr Account Takeover using AWS Cognito APIAnalysed#1342088Authentication2021-12-18–440
Arbitrary file read via ffmpeg HLS parser at https://www.flickr.com/photos/uploadAnalysed#487008Command and Code Injection2020-01-25–340
critical server misconfiguration lead to access to any user sensitive data which include user email and passwordAnalysed#1365738Input Validation and Logic2021-11-02$500116
CSRF in Account Deletion feature (https://www.flickr.com/account/delete)#615448Cross-Site Request Forgery2021-09-14–92
High resource consumption by insufficient sanitization of forum threads pagination#1916400Denial of Service2025-11-24$47975
Incorrect Deep-link validation leading to unresponsive application and device#1157795Input Validation and Logic2024-07-06–64
IDOR may allow access to non-public photos#1737943Insecure Direct Object Reference2024-07-06–61
Stored XSS in photos_user_map.gne#1534636Cross-site Scripting2022-05-23$3,26354
Information Disclosure: .dockerignore file is publicly accessible#2888001No weakness recorded2025-01-14–45
Critical broken cookie signing on dagobah.flickr.com#1440290Input Validation and Logic2022-05-24$47930

Subdomains255

Root
Scope
Name suggests:Staging
First seen
Text fileClear filters9 names
Subdomains of Flickr
NameScopeFirst seen
alpha.flickr.comstagingIn scope2026-11-14
beta1.flickr.comstagingIn scope2026-11-14
beta2.flickr.comstagingIn scope2026-11-14
beta3.flickr.comstagingIn scope2026-11-14
staging.flickr.comstagingIn scope2026-11-14
fts-alpha.flickr.comstagingIn scope2026-11-14
stage.guce.flickr.comstagingListed out of scope2026-11-14
static-alpha.flickr.comstagingIn scope2026-11-14
staging-jubilee.flickr.comstagingIn scope2026-11-14

242 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in