Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Internal Access to Hackerone confluence DocsAnalysed#3113398 | Valid | Misconfiguration and Insecure Design | High | 2025-08-15 | $12,500 | 227 |
| Indexing of urls on the "External link warning" pages discloses many vulnerable endpoints from the past and unlisted videos/photosAnalysed#1034257 | Valid | Misconfiguration and Insecure Design | Medium | 2021-03-25 | – | 194 |
| Account creation with invalid email addresses / email is accepting % and %0d%0a line termination charsAnalysed#815085 | Valid | Misconfiguration and Insecure Design | Low | 2024-02-04 | $3,750 | 176 |
| Hacker.One Subdomain TakeoverAnalysed#159156 | Valid | Misconfiguration and Insecure Design | Low | 2016-09-20 | – | 154 |
| Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONPAnalysed#207042 | Valid | Misconfiguration and Insecure Design | – | 2017-08-29 | – | 153 |
| Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?)Analysed#170310 | Valid | Misconfiguration and Insecure Design | None | 2016-12-08 | – | 76 |
| Homograph fix BypassAnalysed#271324 | Valid | Misconfiguration and Insecure Design | Medium | 2017-10-16 | – | 71 |
| Parameter pollution in social sharing buttonsAnalysed#105953 | Valid | Misconfiguration and Insecure Design | – | 2015-12-19 | $500 | 62 |
| Invalid Host detection at https://hackerone.com/redirectAnalysed#278095 | Valid | Misconfiguration and Insecure Design | Low | 2017-12-03 | – | 57 |
| Register & create a ticket as somebody else on HackerOne SupportAnalysed#2082680 | Valid | Misconfiguration and Insecure Design | None | 2023-07-31 | – | 56 |
| Missing SPF for hackerone.comAnalysed#120 | Valid | Misconfiguration and Insecure Design | – | 2014-01-09 | – | 48 |
| Content Security Policy not applied to error pages at multiple HackerOne endpointsAnalysed#250729 | Valid | Misconfiguration and Insecure Design | Low | 2017-12-12 | – | 45 |
| Email spoofingAnalysed#575 | Valid | Misconfiguration and Insecure Design | – | 2015-05-28 | – | 28 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.