Bug bounty program · HackerOne
Most upvoted reports74
- #946409ValidAnalysedRCE on build server via misconfigured pip installYelp · Supply Chain and Malicious Code · 2021 · needs: no account · Code injection / eval, Dependency confusion / supply chain–366votes
- #2010530ValidAnalysedyelp.com XSS ATO (via login keylogger, link Google account)Yelp · Cross-site Scripting · 2023 · needs: no account · Stored XSS, Account takeover chain, Authentication bypass–324votes
- #391092ValidI.D.O.R To Order,Book,Buy,reserve On YELP FOR FREE (UNAUTHORIZED USE OF OTHER USER'S CREDIT CARD)Yelp · Insecure Direct Object Reference · 2020–214votes
- #2891449ValidObject Level access control leads to reading user's full requests, sessions, and error messagesYelp · Access Control · 2025 · Medium–113votes
- #358143ValidCRITICAL Insecure Direct Object Reference (I.D.O.R) - Link Other User's Credit CardYelp · Information Disclosure · 2020–87votes
- #100926ValidAccess to internal CMS containing private DataYelp · Authentication · 2016–83votes
- #2944357DuplicateUnauthorized Reservation Cancellation Through IDOR VulnerabilityYelp · Insecure Direct Object Reference · 2025 · High–79votes
- #3766455ValidYelp for Business: locked Email field silently editable via APIYelp · Input Validation and Logic · 2026 · Medium–76votes
- #2396549ValidPrivilege Escalation - A Non Owner User Who Does not Have access to the user management can invite other users to the restaurant pageYelp · Access Control · 2025 · Low–75votes
- #1011767ValidX-Forward-For Header allows to bypass access restrictionsYelp · Access Control · 2020–73votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.