Bug bounty program · HackerOne
Most upvoted reports53
- #253429ValidLinux TBB SFTP URI allows local IP disclosureTor · Information Disclosure · 2017$3,00071votes
- #282748ValidDetecting Tor Browser UI LanguageTor · Information Disclosure · 2019–64votes
- #253076ValidXSS on about:tbupdateTor · Cross-site Scripting · 2023$10043votes
- #3701692ValidMalicious Conflux Endpoint Can Leave Stale Global OOO Queue Accounting After TeardownTor · Denial of Service · 2026 · Low$10035votes
- #3709605ValidConflux-queued zero-length RELAY_END triggers heap out-of-bounds readTor · Memory Corruption · 2026 · Medium–33votes
- #1880610ValidSnowflake server: Leak of TLS packets from other clientsTor · Information Disclosure · 2023–30votes
- #252580ValidScrollbar Width permits detecting browser platformTor · Information Disclosure · 2017–29votes
- #3709703ValidTor onion service INTRODUCE2 invalid-MAC cells permanently grow service replay cacheTor · Denial of Service · 2026 · Low–28votes
- #376004InformativePotential IP revealing using UNC Path in Windows File PickerTor · Information Disclosure · 2023–25votes
- #269347InformativeSQL Injection in parameter REPORTTor · SQL Injection · 2023–23votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.