Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Stealing xoxs-tokens using weak postMessage / call-popup redirect to current team domainAnalysed#207170 | Valid | Misconfiguration and Insecure Design | – | 2017-02-28 | – | 120 |
| Linux Desktop application slack executable does not use pie / no ASLRAnalysed#415272 | Valid | Misconfiguration and Insecure Design | Low | 2019-11-17 | $100 | 47 |
| Race Condition in account surveyAnalysed#165570 | Valid | Misconfiguration and Insecure Design | – | 2017-11-12 | – | 29 |
| [Screenhero] Subdomain takeover#142096 | Valid | Misconfiguration and Insecure Design | – | 2017-01-21 | – | 23 |
| Possibility to freeze/crash the host system of all Slack Desktop users easily#392728 | Valid | Misconfiguration and Insecure Design | Low | 2020-11-10 | – | 9 |
| Broken Authentication (including Slack OAuth bugs)#2559 | Valid | Misconfiguration and Insecure Design | – | 2014-08-30 | – | 8 |
| RC4 cipher suites detected on status.slack.com#99157 | Valid | Misconfiguration and Insecure Design | – | 2016-11-18 | – | 6 |
| Password Policy issue (Weak Protect)#17160 | Valid | Misconfiguration and Insecure Design | – | 2014-09-04 | – | 5 |
| Content Spoofing all Integrations in https://team.slack.com/services/new/#22093 | Valid | Misconfiguration and Insecure Design | – | 2014-09-03 | $200 | 4 |
| User impersonation is possible with incoming webhooks#3722 | Informative | Misconfiguration and Insecure Design | – | 2014-04-10 | – | 3 |
| Content Spoofing#2979 | Informative | Misconfiguration and Insecure Design | – | 2014-08-11 | – | 3 |
| HTTP Strict Transport Policy not enabled on newly made accounts#26763 | Valid | Misconfiguration and Insecure Design | – | 2014-10-03 | – | 2 |
| Content spoofing at Stripe Integrations#21248 | Valid | Misconfiguration and Insecure Design | – | 2014-08-25 | $100 | 2 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,686 analysed so far), which can be wrong. Data as of 2026-11-15.