Bug bounty program · HackerOne
Most upvoted reports63
- #2524562N/AIDOR to view order information of users and personal informationWakaTime · Insecure Direct Object Reference · 2024–126votes
- #3279508ValidUnauthorized Disclosure of Private Emails via WakaTime Private LeaderboardsWakaTime · Information Disclosure · 2025 · Medium–93votes
- #3091909ValidLeaked credentials ( emails and passwords , etc...)WakaTime · Information Disclosure · 2025 · None–77votes
- #3090641ValidLogin Information and Credentials Have Been Leaked on wakatime.comWakaTime · Information Disclosure · 2025 · None–74votes
- #3003716ValidUser Email Disclosure via ID-Based InvitationWakaTime · Information Disclosure · 2025 · Medium–73votes
- #3098717Validuser api key leakedWakaTime · Information Disclosure · 2025 · None–65votes
- #3114132ValidBroken Access Control Exposes Email Verification Status and Privacy Settings via API EndpointWakaTime · Access Control · 2025 · Low–57votes
- #3287060ValidDouble Clickjacking Attack on WakaTime OAuth Authorization Flow at https://wakatime.com/oauth/authorizeWakaTime · Misconfiguration and Insecure Design · 2025 · Medium–57votes
- #3120790InformativeSession Replay Attack Allows Authentication Bypass via Captured Login Responses Allowing Bypass of 429 Too many attempts for Multiple Failed LoginsWakaTime · Authentication · 2025 · High–54votes
- #3248712N/ANot a Vuln: Race Condition Allows Creation of Multiple Organizations with the Same NameWakaTime · Input Validation and Logic · 2025 · None–40votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.