Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Team admin can change unauthorized team setting (require_at_for_mention)#46747	Valid	Access Control	–	2015-04-30	$200	3
Team admin can change unauthorized team setting (allow_message_deletion)#46750	Valid	Access Control	–	2015-05-30	$100	3
Team admin can add billing contacts#47940	Valid	Access Control	–	2015-04-03	$200	3
File upload over private IM channel#143903	Valid	Access Control	–	2016-07-13	–	5
User can start call in a channel of an unpaid account#147369	Valid	Access Control	–	2016-09-15	$100	10
Creating Post on a restricted channel#151459	Valid	Access Control	–	2016-09-29	–	10
CSV export/import functionality allows administrators to modify member and message content of a workspace#1661310	Informative	Access Control	None	2022-09-28	$250	11
Cross-site leak allows attacker to de-anonymize members of his team from another origin#1068153	Valid	Access Control	Low	2021-11-11	$250	13
Misuse of groups feature allows workspace members to join private channels without being invitedAnalysed#1248852	Valid	Access Control	High	2021-10-21	–	23
Access of Android protected components via embedded intentAnalysed#200427	Valid	Access Control	Critical	2017-07-17	–	31

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.