Skip to content
Sign in

Bug bounty program

GI

GitLab

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
19
Disclosed reports
257
Subdomains
785

Most upvoted reports257

All reports
Most upvoted reports of GitLab
ReportWeaknessDisclosedBountyVotes
Arbitrary file read via the UploadsRewriter when moving and issueAnalysed#827052File and Path Handling2020-04-27$20,0001,503
Account Takeover via Password Reset without user interactionsAnalysed#2293343Access Control2025-02-26$35,000989
Git flag injection - local file overwrite to remote code executionAnalysed#658013Command and Code Injection2019-12-19$12,000777
Exfiltrate and mutate repository and project data through injected templated serviceAnalysed#446585Access Control2019-03-05$11,000762
Stored XSS in Wiki pagesAnalysed#526325Cross-site Scripting2019-09-02–633
Local files could be overwritten in GitLab, leading to remote command executionAnalysed#587854Command and Code Injection2019-07-17$12,000542
RCE when removing metadata with ExifToolAnalysed#1154542Command and Code Injection2021-05-14$20,000508
Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requestsAnalysed#689314Access Control2019-11-27$12,000457
RCE via unsafe inline Kramdown options when rendering certain Wiki pagesAnalysed#1125425Command and Code Injection2021-04-20$20,000427
gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be readAnalysed#850447Information Disclosure2020-06-08$10,000410

Subdomains785

Root
Scope
Name suggests:Test and QA
First seen
Text fileClear filters7 names
Subdomains of GitLab
NameScopeFirst seen
centos-test.gitlab.comtestNot in the scope2026-11-14
demo.gitlab.comtestNot in the scope2026-11-14
runway-ci-test-4jpyc3.staging.runway.gitlab.comci, staging, testNot in the scope2026-11-14
test-jm-proxy.runway.gitlab.comtestNot in the scope2026-11-14
cert-test.staging.gitlab.comstaging, testNot in the scope2026-11-14
test.gitlab.comtestNot in the scope2026-11-14
ws-test.gitter.imtestNot in the scope2026-11-14

6 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in