Bug bounty program · HackerOne
Ruby on Rails
Most upvoted reports73
- #519220ValidFile writing by Directory traversal at actionpack-page_caching and RCE by itRuby on Rails · File and Path Handling · 2020$1,00080votes
- #3008446Informative1-Click Cross-Site Scripting via Custom Configuration in SafeListSanitizerRuby on Rails · Cross-site Scripting · 2025 · Medium–70votes
- #3580511ValidActiveStorage Disk Service Path Traversal via Custom Blob Key InjectionRuby on Rails · File and Path Handling · 2026 · Medium–57votes
- #2303609ValidXSS when using `translate` in Action Controller (Rails 7.0, 7.1)Ruby on Rails · Cross-site Scripting · 2024 · Low–50votes
- #895727ValidRack parses encoded cookie names allowing an attacker to send malicious `__Host-` and `__Secure-` prefixed cookiesRuby on Rails · Input Validation and Logic · 2020–46votes
- #473888ValidRCE which may occur due to `ActiveSupport::MessageVerifier` or `ActiveSupport::MessageEncryptor` (especially Active storage)Ruby on Rails · Command and Code Injection · 2019$1,50041votes
- #1444151ValidXSS vulnerabilities due to missing checks in tag helpersRuby on Rails · Cross-site Scripting · 2023–41votes
- #307808ValidPath Traversal on Default Installed Rails Application (Asset Pipeline)Ruby on Rails · File and Path Handling · 2018$1,50038votes
- #2334455InformativePath traversal in AcitveStorage, and lead RCERuby on Rails · File and Path Handling · 2024 · High–37votes
- #1023899ValidRegular expression denial of service in ActiveRecord's PostgreSQL Money typeRuby on Rails · Denial of Service · 2021–33votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.