Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
WeaknessMisconfiguration and Insecure Design
- Any class
- Cross-site Scripting1
- Cross-Site Request Forgery1
- Open Redirect1
- Command and Code Injection7
- Injection and Smuggling4
- Deserialization and Object Injection1
- Denial of Service1
- Input Validation and Logic1
- Misconfiguration and Insecure Design3
- Cryptography1
- Information Disclosure3
- Authentication1
- Access Control14
- Insecure Direct Object Reference6
- No weakness recorded2
3 of 15,219 reports · $4,617 in bounties · 161 analysed so far
- #2357443ValidRC Between GitHub's Repo Update REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access RetentionGitHub · Misconfiguration and Insecure Design · 2024 · Medium–50votes
- #2216036ValidRC Between GitHub's Repo Transfer REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access RetentionGitHub · Misconfiguration and Insecure Design · 2024–50votes
- #1625652ValidDelimiter injection in GitHub Actions core.exportVariableGitHub · Misconfiguration and Insecure Design · 2022$4,61739votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.