Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Cross-site Scripting (XSS) - Stored in RDoc wiki pagesAnalysed#662287 | Valid | Misconfiguration and Insecure Design | High | 2019-12-16 | $3,500 | 282 |
| Ability To Delete User(s) Account Without User InteractionAnalysed#928255 | Valid | Misconfiguration and Insecure Design | High | 2021-03-17 | – | 221 |
| Subdomain takeover in Gitlab pagesAnalysed#2523654 | Valid | Misconfiguration and Insecure Design | Low | 2024-10-09 | – | 79 |
| Remove obsolete domain from handbook subdomainAnalysed#2599840 | Valid | Misconfiguration and Insecure Design | Low | 2024-10-01 | – | 72 |
| Bypass Email Verification using Salesforce -- Reproducible in gitlab.com#617896 | Valid | Misconfiguration and Insecure Design | High | 2019-12-13 | – | 55 |
| Change project visibility to a restricted option#1086781 | Valid | Misconfiguration and Insecure Design | Medium | 2021-12-30 | $1,370 | 51 |
| Insecure 2FA/authentication implementation creates a brute force vulnerability#149598 | Valid | Misconfiguration and Insecure Design | – | 2016-10-28 | – | 33 |
| A profile page of a user can be denied from loading by appending .html to the username#475098 | Valid | Misconfiguration and Insecure Design | Low | 2021-08-30 | $200 | 26 |
| Gitlab is vulnerable to impersonation attacks due to broken links#265696 | Valid | Misconfiguration and Insecure Design | – | 2017-09-06 | – | 21 |
| Impersonation attack via Broken Link in Resellers Page#266908 | Valid | Misconfiguration and Insecure Design | – | 2017-09-08 | – | 12 |
| Gitlab.com is vulnerable to reverse tabnabbing. (#2)#212629 | Valid | Misconfiguration and Insecure Design | – | 2017-05-09 | – | 8 |
| Gitlab.com is vulnerable to reverse tabnabbing via AsciiDoc links. (#3)#213114 | Valid | Misconfiguration and Insecure Design | – | 2017-05-09 | – | 5 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,443 analysed so far), which can be wrong. Data as of 2026-11-15.