Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Twitter Periscope Clickjacking VulnerabilityAnalysed#591432 | Valid | Misconfiguration and Insecure Design | Medium | 2019-07-10 | $1,120 | 144 |
| Highly wormable clickjacking in player cardAnalysed#85624 | Valid | Misconfiguration and Insecure Design | – | 2018-05-17 | – | 134 |
| Viral Direct Message Clickjacking via link truncation leading to capture of both Google credentials & installation of malicious 3rd party Twitter AppAnalysed#643274 | Valid | Misconfiguration and Insecure Design | High | 2019-10-31 | – | 64 |
| Stealing User emails by clickjacking cards.twitter.com/xxx/xxxAnalysed#154963 | Valid | Misconfiguration and Insecure Design | Medium | 2017-02-03 | – | 49 |
| Clickjacking Periscope.tv on Chrome#198622 | Valid | Misconfiguration and Insecure Design | Medium | 2017-02-06 | $560 | 11 |
| Improper Verification of email address while saving Account Settings#30975 | Valid | Misconfiguration and Insecure Design | – | 2015-08-13 | $560 | 6 |
| Headers Missing#36053 | Informative | Misconfiguration and Insecure Design | – | 2014-11-15 | – | 3 |
| Homograph attack.#37108 | Informative | Misconfiguration and Insecure Design | – | 2015-01-01 | – | 2 |
| BROKEN AUTHENTICATION IN MOBILE VERIFICATION#33432 | Informative | Misconfiguration and Insecure Design | – | 2014-12-14 | – | 2 |
| Creating Unauthorized Audience Lists#31188 | Informative | Misconfiguration and Insecure Design | – | 2014-11-28 | – | 2 |
| Unauthorized Tweeting on behalf of Account Owners#31082 | Valid | Misconfiguration and Insecure Design | – | 2015-05-07 | $420 | 2 |
| Following a User After Favoriting Actually Follows Another User (related to #95243)#97510 | Valid | Misconfiguration and Insecure Design | – | 2015-12-02 | $280 | 1 |
| No rate limiting on creating lists#42250 | Informative | Misconfiguration and Insecure Design | – | 2015-01-06 | – | 1 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.