Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| CSRF bug on password change#230436 | N/A | Cross-Site Request Forgery | – | 2017-08-28 | – | – |
| CSRF in function "Set as primary" on accounts page#10829 | Valid | Cross-Site Request Forgery | – | 2014-06-06 | – | 1 |
| Csrf bug on signup session#230428 | Informative | Cross-Site Request Forgery | – | 2017-08-30 | – | 2 |
| CSRF on "Set as primary" option on the accounts page#10563 | Valid | Cross-Site Request Forgery | – | 2014-07-26 | $100 | 3 |
| The 'Create a New Account' action is vulnerable to CSRF#109810 | N/A | Cross-Site Request Forgery | – | 2016-07-24 | – | 4 |
| Leaking CSRF token over HTTP resulting in CSRF protection bypass#15412 | Valid | Cross-Site Request Forgery | – | 2014-10-16 | $1,000 | 7 |
| XSSI (Cross Site Script Inclusion)#118631 | Valid | Cross-Site Request Forgery | – | 2017-08-22 | – | 15 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,190 analysed so far), which can be wrong. Data as of 2026-11-15.