Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| View Titles of Private Reports with pending email invitationAnalysed#2312029 | Valid | Access Control | High | 2024-01-16 | – | 257 |
| Takeover of hackerone.engineering via GithubAnalysed#2085260 | Valid | Access Control | Medium | 2023-07-31 | – | 135 |
| Scope information is leaked when visiting policy scopes tab of any External ProgramAnalysed#1868473 | Valid | Access Control | Medium | 2023-03-10 | – | 86 |
| Unauthenticated users can obtain information about Checklist objects with unclaimed ChecklistCheck objectsAnalysed#781175 | Valid | Access Control | Medium | 2020-03-20 | – | 59 |
| Graphql: Sorting the reports by jira_status field resulted to different valueAnalysed#955286 | Valid | Access Control | Low | 2020-08-27 | – | 20 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.