Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| CSRF AT SELECTING ZAMATO HANDLE#113857 | Valid | Cross-Site Request Forgery | – | 2016-03-18 | – | 5 |
| CSRF To Like/Unlike Photos#230837 | Valid | Cross-Site Request Forgery | Medium | 2017-06-30 | – | 5 |
| CSRF in the "Add restaurant picture" function#169699 | Valid | Cross-Site Request Forgery | – | 2017-09-14 | $50 | 8 |
| Twitter Disconnect CSRF#114127 | Valid | Cross-Site Request Forgery | – | 2016-09-30 | – | 9 |
| The vulnerabilities found were XSS, Public disclosure, Network enumeration via CSRF, DLL hijacking.#927413 | N/A | Cross-Site Request Forgery | – | 2020-07-21 | – | 11 |
| Posting to Twitter CSRF on php/post_twitter_authenticate.php#249234 | Valid | Cross-Site Request Forgery | Low | 2017-08-19 | $50 | 15 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.