Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Fabric.io - an app admin can delete team members from other user apps#43065	Valid	Access Control	–	2015-03-09	$1,120	3
Can see private tweets via keyword searches on tweetdeck#97161	Valid	Access Control	–	2016-02-16	–	3
fabric.io - app member can make himself an admin#42961	Valid	Access Control	–	2015-03-09	$1,400	4
Fabric.io: Ex-admin of an organization can delete team members#55670	Valid	Access Control	–	2015-11-01	$280	8
Insecure Direct Object Reference - access to other user/group DM's#53858	Valid	Access Control	–	2015-10-03	–	10
PI leakage By Brute Forcing and Phone number deleting without using password#1087525	Duplicate	Access Control	Medium	2021-04-22	–	16
Remote 0click exfiltration of Safari user's IP addressAnalysed#1392211	Valid	Access Control	Medium	2022-06-15	$560	28
2 Subdomains Takeover at readfu.comAnalysed#1073114	Valid	Access Control	Medium	2021-03-15	–	35
[IDOR][translate.twitter.com] Opportunity to change any comment at the forumAnalysed#181748	Valid	Access Control	Low	2017-05-12	–	38
Periscope-all Firebase database takeoverAnalysed#684099	Valid	Access Control	Critical	2019-09-25	–	49
Subdomain takeover on dev-admin.periscope.tvAnalysed#531890	Valid	Access Control	Medium	2019-05-28	–	55
Ability to see hidden likesAnalysed#2140960	Valid	Access Control	Medium	2024-05-10	–	83
Able to see Twitter Circle tweets due to improper access control on the "FavoriteTweet" endpointAnalysed#1694304	Valid	Access Control	Medium	2024-03-01	–	91
Twitter lite(Android): Vulnerable to local file steal, Javascript injection, Open redirectAnalysed#499348	Valid	Access Control	Critical	2019-04-29	–	95
Verify any unused email addressAnalysed#574962	Valid	Access Control	–	2019-06-24	$560	197
Discoverability by phone number/email restriction bypassAnalysed#1439026	Valid	Access Control	High	2022-02-11	$5,040	217
Private list members disclosure via GraphQLAnalysed#885539	Valid	Access Control	Low	2020-08-04	–	346
Read-only application can publish/delete fleetsAnalysed#1032468	Valid	Access Control	Medium	2021-01-04	–	398

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.