Bug bounty program · HackerOne
Stellar.org
Most upvoted reports10
- #330105ValidExploitable vulnerability in SDEXStellar.org · Input Validation and Logic · 2018–29votes
- #342977Informativebrute force attack allowed on admin page https://www.stellar.org/wp-admin/Stellar.org · Authentication · 2020–16votes
- #321511ValidIt's possible to put SDX orderbook into invalid state and execute trades at arbitrary priceStellar.org · Input Validation and Logic · 2018–12votes
- #263780InformativeDirect URL access to PDF filesStellar.org · Access Control · 2020–10votes
- #240659Validheap-buffer-overflow (READ of size 1) in cpptoml::parser::consume_whitespace()Stellar.org · Memory Corruption · 2017–8votes
- #242874InformativeBypassing Verify Humans PageStellar.org · Authentication · 2020–8votes
- #239479N/AHTTP - Basic Authentication on https://www.stellar.org/wp-login.phpStellar.org · Misconfiguration and Insecure Design · 2017–7votes
- #281387InformativexssStellar.org · No weakness recorded · 2020–6votes
- #239380InformativeSession Cookie without HttpOnly and secure flag setStellar.org · Misconfiguration and Insecure Design · 2017–4votes
- #376563N/AAdmin panel of https://www.stellar.org/wp-admin/Stellar.org · Misconfiguration and Insecure Design · 2020–3votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.