Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
WeaknessDenial of Service
- Any class
- Cross-site Scripting57
- Cross-Site Request Forgery6
- Open Redirect5
- Server-Side Request Forgery18
- SQL Injection1
- Command and Code Injection18
- Injection and Smuggling4
- File and Path Handling5
- Memory Corruption1
- Denial of Service14
- Input Validation and Logic7
- Misconfiguration and Insecure Design15
- Information Disclosure32
- Authentication9
- Access Control52
- Insecure Direct Object Reference12
- No weakness recorded1
14 of 15,219 reports · $17,840 in bounties · 227 analysed so far
- #470067ValidDoS on the Issue page by exploiting Mermaid.GitLab · Denial of Service · 2019$3,000145votes
- #557154ValidDoS attack via comment on IssueGitLab · Denial of Service · 2019$1,00084votes
- #1160407ValidCache poisoning Denial of Service affecting assets.gitlab-static.netGitLab · Denial of Service · 2021–83votes
- #2499070ValidDOS: taking down a 1k users Gitlab EE instance or multiple Sidekiq instances by importing a malicious repo from a Github EE self-hosted serverGitLab · Denial of Service · 2024 · Medium$2,30064votes
- #511381ValidAll functions that allow users to specify color code are vulnerable to ReDoSGitLab · Denial of Service · 2019$1,00053votes
- #549040ValidClientside resource Exhausting by exploiting gitlab math renderingGitLab · Denial of Service · 2019–50votes
- #670572ValidUncontrolled Resource Consumption in any Markdown field using MermaidGitLab · Denial of Service · 2019–31votes
- #702987ValidNo redirect_uri in the db for web-internal clientKey leads to one-click DoS on gitter.imGitLab · Denial of Service · 2020–26votes
- #1543718ValidDOS via issue previewGitLab · Denial of Service · 2022$7,64025votes
- #1772063ValidReDoS due to device-detector parsing user agentsGitLab · Denial of Service · 2024 · Medium–23votes
- #1543584ValidDOS via move_issueGitLab · Denial of Service · 2022$2,30019votes
- #1283484ValidReDoS in syntax highlighting due to RougeGitLab · Denial of Service · 2021$60013votes
- #1531958ValidReDoS in net/http affects webhooks: Sidekiq job stuck at 100% CPU for a yearGitLab · Denial of Service · 2022–9votes
- #221041ValidCookie bombGitLab · Denial of Service · 2018–6votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.