Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Program	Weakness	Severity	Disclosed	Bounty	Votes
Unauthenticated Stored XSS on <any>.myshopify.com via checkout pageAnalysed#189378	Valid	Shopify	Cross-site Scripting	–	2016-12-16	–	14
Uninstalling Slack for Windows (64-bit), then reinstalling keeps you logged in without authenticationAnalysed#238260	Valid	Slack	Authentication	Low	2020-11-10	$500	18
Store Deletion or Sell without authenticationAnalysed#1087382	Valid	Shopify	Authentication	Low	2021-10-21	–	20
Uninstalling Mattermost Launcher for Windows (64-bit), then reinstalling keeps you logged in without authenticationAnalysed#1797661	Valid	Mattermost	Authentication	Low	2023-01-14	–	20
Uninstalling Rockstar Games Launcher for Windows (64-bit), then reinstalling keeps you logged in without authenticationAnalysed#1278261	Valid	Rockstar Games	Information Disclosure	Low	2022-04-07	$250	28
Unauthenticated read and write access to ALL endpoints of a store is possible for removed staff members who had "Apps" permissionAnalysed#700831	Valid	Shopify	Input Validation and Logic	Medium	2019-10-10	–	53
Improper Session Invalidation – Auto Sign-In Without Credentials After Logout (Affects Chrome & Firefox)Analysed#3101207	Valid	Dust	Authentication	Medium	2025-04-29	–	56
Autotranslate DDP Method Exposes Private Messages Without Authentication or Room Access CheckAnalysed#3734326	Valid	Rocket.Chat	Insecure Direct Object Reference	High	2026-05-25	–	74
Unauthenticated access to private files on app.fizzy.do via Active Storage URLs leads to information disclosureAnalysed#3467641	Valid	Basecamp	Insecure Direct Object Reference	Low	2026-03-16	$100	76
Docker Registry HTTP API v2 exposed in HTTP without authentication leads to docker images dumping and poisoningAnalysed#347296	Valid	Semmle	Access Control	Critical	2020-06-06	–	83
Zero day path traversal vulnerability in Grafana 8.x allows unauthenticated arbitrary local file readAnalysed#1415820	Valid	Aiven Ltd	File and Path Handling	High	2021-12-14	$1,000	105
Privilege Escalation From user to SYSTEM via unauthenticated command executionAnalysed#544928	Valid	Ubiquiti Inc.	Command and Code Injection	Critical	2019-11-08	–	553

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.