Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| XSRF Token is Not being validated when sending emails test request which lead to CSRF attack using the flash file + 307 redirect technique#799867 | Valid | Cross-Site Request Forgery | Medium | 2020-03-25 | – | 4 |
| No CSRF Protection in Resend Confirmation Email feature leads to Sending Unwanted Email in Victim's Inbox without knowing Victim's email address#753386 | Valid | Cross-Site Request Forgery | Medium | 2020-09-08 | – | 12 |
| CSRF - Modify Project Settings#766533 | Valid | Cross-Site Request Forgery | Critical | 2020-02-03 | – | 13 |
| csrf bypass using flash file + 307 redirect method at plugins endpoint#766205 | Valid | Cross-Site Request Forgery | Medium | 2020-02-10 | – | 15 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.