Bug bounty program · HackerOne
Tools for Humanity
Most upvoted reports4
- #2515808Valid[Meetup][World ID][OIDC] Insufficient Filtering of "state" Parameter in Response Mode form_post leads to XSS and ATOTools for Humanity · Cross-site Scripting · 2024 · Critical–106votes
- #2110030ValidRace Condition Enables Bypassing Verification CheckTools for Humanity · Race Conditions · 2024$3,00095votes
- #2381816ValidIDOR - Leaking of team data (name, email, ID, member ID) via POST /api/v1/graphql `FetchMemberships` operationTools for Humanity · Insecure Direct Object Reference · 2024$50091votes
- #3136790ValidUnlock underage blocked app without support interaction using airplane modeTools for Humanity · Input Validation and Logic · 2025 · Low$30066votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.