Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Blind SQLi leading to RCE, from Unauthenticated access to a test API WebserviceAnalysed#592400 | Valid | SQL Injection | Critical | 2019-07-22 | – | 236 |
| China – Limited Partner PII Regarding Work Scheduling via Unauthenticated API EndpointAnalysed#659248 | Valid | Information Disclosure | Critical | 2020-04-01 | – | 116 |
| Thailand - a small number of SMB CCTV footage backup servers were accessible without authentication.Analysed#417360 | Valid | Access Control | Medium | 2019-11-19 | – | 99 |
| Store Development Resource Center was vulnerable to a Remote Code Execution - Unauthenticated Remote Command Injection (CVE-2019-0604)Analysed#536134 | Valid | Command and Code Injection | Critical | 2019-12-12 | – | 57 |
| Sidekiq web UI (Ruby background processing) accessible unauthenticated via https://gift-test.starbucks.co.jp/sidekiq/busyAnalysed#423286 | Valid | Access Control | Medium | 2018-10-24 | – | 16 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.