Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| adding h1_analyst_* to username for normal usersAnalysed#1770797 | Valid | Input Validation and Logic | Low | 2023-04-12 | $500 | 187 |
| [ Spot Check ] Team members can edit a user's write-upAnalysed#2530242 | Valid | Access Control | Low | 2024-06-06 | – | 149 |
| Program Member Could Duplicate Report To A Non Related Program Original ReportAnalysed#2513082 | Valid | Access Control | High | 2024-06-19 | – | 104 |
| Triager/Team members can edit hacker's report and hacker is not even notifiedAnalysed#2061367 | Valid | No weakness recorded | Medium | 2023-08-31 | $2,500 | 84 |
| Reporter, external users, collaborators can mark sent swag awarded to reporter as unsentAnalysed#717729 | Valid | Insecure Direct Object Reference | Medium | 2019-10-25 | – | 76 |
| Organization members can delete reports in teams they have no access toAnalysed#2203432 | Valid | Access Control | Medium | 2023-11-22 | – | 57 |
| Read-only team members can read all properties of webhooksAnalysed#818848 | Valid | Access Control | Low | 2020-04-29 | – | 30 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.