Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Recently added 'Country' field doesn't send email notification when changedAnalysed#961841 | Valid | Misconfiguration and Insecure Design | Low | 2020-08-25 | – | 108 |
| Password not checked when disabling 2FA on HackerOneAnalysed#587910 | Valid | Misconfiguration and Insecure Design | Low | 2019-06-07 | – | 95 |
| Domain highlighting on External link warning is not working on Chrome & Microsoft Edge browsers on MobileAnalysed#2553026 | Valid | Misconfiguration and Insecure Design | Low | 2025-03-13 | – | 82 |
| 2M Reports on HackerOne Celebration! - Ability to bulk-submit many reports.Analysed#2000000 | Valid | Misconfiguration and Insecure Design | Low | 2023-07-11 | – | 54 |
| Google Analytics could be used as CSP bypass for data exfiltration on hackerone.comAnalysed#199779 | Valid | Misconfiguration and Insecure Design | Low | 2017-03-26 | – | 44 |
| Private program email forwarding response invitation not expire after first use.Analysed#209140 | Valid | Misconfiguration and Insecure Design | High | 2018-05-30 | – | 38 |
| Ability to bulk submit reports via query named based batchingAnalysed#2166697 | Valid | Misconfiguration and Insecure Design | Low | 2024-06-19 | $500 | 37 |
| Common response suggestion is sent to Google Analytics when user accepts duplicate comment Genius suggestionAnalysed#297181 | Valid | Misconfiguration and Insecure Design | Low | 2018-01-22 | $500 | 37 |
| HackerOne Integrations Design IssueAnalysed#172289 | Valid | Misconfiguration and Insecure Design | Medium | 2019-04-11 | $500 | 36 |
| Updating payout preference to CurrencyCloud doesn't notify user via emailAnalysed#240083 | Valid | Misconfiguration and Insecure Design | None | 2018-01-31 | $500 | 35 |
| CSRF at [Apply to this program] that lead to submit your request automatic with out any validationsAnalysed#334253 | Valid | Misconfiguration and Insecure Design | Low | 2018-07-05 | – | 30 |
| Report redaction doesn't apply to report title update activitiesAnalysed#196358 | Valid | Misconfiguration and Insecure Design | Low | 2017-02-25 | – | 27 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.