Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
19
Disclosed reports
257
Subdomains
786
Vendor on CyberSIXT
GitLab (1,521 CVEs, 6 exploited)

Most upvoted reports257

All reports
Most upvoted reports of GitLab
ReportWeaknessDisclosedBountyVotes
Arbitrary file read via the UploadsRewriter when moving and issueAnalysed#827052File and Path Handling2020-04-27$20,0001,503
Account Takeover via Password Reset without user interactionsAnalysed#2293343Access Control2025-02-26$35,000989
Git flag injection - local file overwrite to remote code executionAnalysed#658013Command and Code Injection2019-12-19$12,000777
Exfiltrate and mutate repository and project data through injected templated serviceAnalysed#446585Access Control2019-03-05$11,000762
Stored XSS in Wiki pagesAnalysed#526325Cross-site Scripting2019-09-02–633
Local files could be overwritten in GitLab, leading to remote command executionAnalysed#587854Command and Code Injection2019-07-17$12,000542
RCE when removing metadata with ExifToolAnalysed#1154542Command and Code Injection2021-05-14$20,000508
Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requestsAnalysed#689314Access Control2019-11-27$12,000457
RCE via unsafe inline Kramdown options when rendering certain Wiki pagesAnalysed#1125425Command and Code Injection2021-04-20$20,000427
gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be readAnalysed#850447Information Disclosure2020-06-08$10,000410

Subdomains786

Subdomains of GitLab
NameScopeFirst seen
4456656-review-beckalippe-9ayot8.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-beckalippe-x55gz2.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-beckalippe-yi346l.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-better-err-r52kcp.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-bugfix-loc-qvog2t.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-cam-x-main-r0jpo8.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-cluster-te-ahlmff.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-codeowners-98nl8j.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-color-pale-e7ltzf.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-danmh-add-939zv6.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-danmh-base-jxzqod.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-danmh-figm-ecofo8.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-danmh-labe-7m5eaz.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-danmh-line-602hhc.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-danmh-link-zzbmci.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-danmh-main-7byn0x.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-danmh-main-8m9u8a.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-danmh-main-c1cmm0.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-danmh-main-l30vd9.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-danmh-ui-k-1zf7up.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-danmh-ui-k-ar8xlq.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-decrease-f-yjhr8g.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-design-tok-kolgon.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-dev-1443-u-micvmc.design-staging.gitlab.comdev, stagingNot in the scope2026-11-14
4456656-review-dmoraberli-v9tcck.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-do-not-for-pzqdfc.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-docs-headi-iwghf9.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-dropdown-u-xey22m.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-editaction-iyfa0g.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-email-obfu-vz3rnd.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-eread-add-z47gmh.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-feat-add-d-6hvldh.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-feat-add-i-jfatva.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-feat-add-n-atvmbp.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-feat-typog-iods1d.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-feature-ve-83unpv.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-feature-ve-84glmd.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-feedback-a-2mclaz.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-figma-chan-m8wo3e.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-figure-img-csecdr.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-fix-broken-484psj.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-fix-broken-qybukn.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-fix-dropdo-pxfde4.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-fix-lockfi-xfj7fu.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-fix-main-a8e81c.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-fix-punctu-7gmkwg.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-fix-socks-qqsw5a.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-fix-templa-rmaij2.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-frontend-o-k89w9g.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-gdoyle-mai-ydq5be.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-gitlab-ui-l35n7g.design-staging.gitlab.comgit, stagingNot in the scope2026-11-14
4456656-review-gl-global-ehsdxl.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-glpathupda-ppzo2c.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-gt-update-7ocwl1.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-helping-us-ab9za1.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-init-ui-ki-9s5r7x.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-jeldergl-m-6ft9af.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-jeldergl-m-94oflr.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-jeldergl-m-i8pqtg.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-jeldergl-m-wl40lx.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-jlouw-fix-3hbdqy.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-katiemacoy-28xw6w.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-katiemacoy-6kowxh.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-katiemacoy-6mkyxy.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-katiemacoy-9w1w8o.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-kbd-styles-3wqnci.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-ld-remove-s98iax.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-leipert-ad-yv3s6o.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-leipert-de-ukc4pq.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-leipert-fi-8xvt9u.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-leipert-fi-a93rup.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-leipert-fi-b4f198.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-leipert-in-fn9qbu.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-leipert-me-2kf6ib.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-leipert-pi-ylw4l9.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-leipert-re-odlobn.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-leipert-so-fnmdgi.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-leipert-sv-zlo2if.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-leipert-sw-gx6s02.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-leipert-te-1f4hg0.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-link-mh9siw.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-link-updat-3hh8ij.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-loadmore-53edp1.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-loadmoregu-u81fud.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-lookbook-e-vm97y9.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-lvanc-feat-c4vnls.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-lvanc-main-vhyovi.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-main-patch-09hgox.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-main-patch-0hbs2y.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-main-patch-17vfv3.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-main-patch-1axc6b.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-main-patch-43rhv4.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-main-patch-5jw3b1.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-main-patch-5uc0jr.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-main-patch-6j8uwc.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-main-patch-6yplki.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-main-patch-7vaf0e.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-main-patch-7zq31d.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-main-patch-9ymnv2.design-staging.gitlab.comstagingNot in the scope2026-11-14
4456656-review-main-patch-ahykfo.design-staging.gitlab.comstagingNot in the scope2026-11-14

6 names are covered by the program's own scope; 1 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.