Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Invited team member can disclosure slack channels#509574	Valid	Information Disclosure	Low	2019-04-05	$500	16
Read-only team members can read all properties of webhooks#818848	Valid	Access Control	Low	2020-04-29	–	30
Organization members can delete reports in teams they have no access to#2203432	Valid	Access Control	Medium	2023-11-22	–	57
Reporter, external users, collaborators can mark sent swag awarded to reporter as unsentAnalysed#717729	Valid	Insecure Direct Object Reference	Medium	2019-10-25	–	76
Triager/Team members can edit hacker's report and hacker is not even notifiedAnalysed#2061367	Valid	No weakness recorded	Medium	2023-08-31	$2,500	84
Program Member Could Duplicate Report To A Non Related Program Original ReportAnalysed#2513082	Valid	Access Control	High	2024-06-19	–	104
[ Spot Check ] Team members can edit a user's write-upAnalysed#2530242	Valid	Access Control	Low	2024-06-06	–	149
adding h1_analyst_* to username for normal usersAnalysed#1770797	Valid	Input Validation and Logic	Low	2023-04-12	$500	187

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,199 analysed so far), which can be wrong. Data as of 2026-11-14.