Bug bounty program · HackerOne
Most upvoted reports5
- #2718253ValidEmail verification bypass via request to endpoint "accounts.insightly.com/signup/provisionuser"Insightly · Access Control · 2025 · Critical–148votes
- #1392262ValidStored XSS via LINK Name.Insightly · Cross-site Scripting · 2025 · High–107votes
- #1597271ValidStored XSS in Email NotifcationInsightly · Cross-site Scripting · 2025 · Medium–101votes
- #1544236ValidreturnUrl= allow attacker to redirect users to the another phising website and takeover credientialsInsightly · Authentication · 2025 · Medium–94votes
- #1668489ValidCSRF vulnerability allows disabling Gmail contacts link for user referralsInsightly · Cross-Site Request Forgery · 2025 · Medium–70votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.