Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| adding h1_analyst_* to username for normal users#1770797 | Valid | Input Validation and Logic | – | 2023-04-12 | $500 | 187 |
| [ Spot Check ] Team members can edit a user's write-up#2530242 | Valid | Access Control | Low | 2024-06-06 | – | 149 |
| Program Member Could Duplicate Report To A Non Related Program Original Report#2513082 | Valid | Access Control | High | 2024-06-19 | – | 104 |
| Triager/Team members can edit hacker's report and hacker is not even notified#2061367 | Valid | No weakness recorded | – | 2023-08-31 | $2,500 | 84 |
| Reporter, external users, collaborators can mark sent swag awarded to reporter as unsent#717729 | Valid | Insecure Direct Object Reference | – | 2019-10-25 | – | 76 |
| Organization members can delete reports in teams they have no access to#2203432 | Valid | Access Control | – | 2023-11-22 | – | 57 |
| Read-only team members can read all properties of webhooks#818848 | Valid | Access Control | – | 2020-04-29 | – | 30 |
| Invited team member can disclosure slack channels#509574 | Valid | Information Disclosure | – | 2019-04-05 | $500 | 16 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.