Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Triager/Team members can edit hacker's report and hacker is not even notifiedAnalysed#2061367 | Valid | No weakness recorded | Medium | 2023-08-31 | $2,500 | 84 |
| Reporter, external users, collaborators can mark sent swag awarded to reporter as unsentAnalysed#717729 | Valid | Insecure Direct Object Reference | Medium | 2019-10-25 | – | 76 |
| Organization members can delete reports in teams they have no access toAnalysed#2203432 | Valid | Access Control | Medium | 2023-11-22 | – | 57 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.