Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Publicly accessible Continuous Integration ToolAnalysed#313457 | Valid | Access Control | Critical | 2021-07-29 | – | 562 |
| RCE/LFI on test Jenkins instance due to improper authentication flowAnalysed#258117 | Valid | Access Control | Medium | 2017-08-19 | – | 118 |
| Client IP Spoofing using "X-Forwarded-For: 127.0.0.1" on "studio-app.snapchat.com" exposing bucket detailsAnalysed#382678 | Valid | Access Control | High | 2021-08-12 | $500 | 40 |
| Domain Takeover in [obviousengine.com] a snapchat acquisitionsAnalysed#392785 | Valid | Access Control | High | 2018-10-07 | – | 32 |
| Organization Members in Snap Kit may Deactivate AppsAnalysed#1103448 | Valid | Access Control | Low | 2021-08-26 | – | 26 |
| Subdomain Takeover via unclaimed UserVoice domainAnalysed#269109 | Valid | Access Control | High | 2017-10-04 | $250 | 18 |
| Password Reset - query param overrides postdata#96636 | Valid | Access Control | – | 2015-12-24 | $1,500 | 12 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.