Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
WeaknessInsecure Direct Object Reference
- Any class
- Cross-site Scripting1
- Cross-Site Request Forgery1
- Open Redirect1
- Command and Code Injection7
- Injection and Smuggling4
- Deserialization and Object Injection1
- Denial of Service1
- Input Validation and Logic1
- Misconfiguration and Insecure Design3
- Cryptography1
- Information Disclosure3
- Authentication1
- Access Control14
- Insecure Direct Object Reference6
- No weakness recorded2
6 of 15,219 reports · $10,000 in bounties · 161 analysed so far
- #3124517ValidArbitrary Read of Another Users private repository without AuthorizationGitHub · Insecure Direct Object Reference · 2025 · High$10,000276votes
- #3560256ValidCross-repository IDOR in `/settings/security_analysis/bypass_reviewers` allows unauthorized delegated bypass reviewer modificationGitHub · Insecure Direct Object Reference · 2026 · Medium–108votes
- #3506183ValidMissing Access Control in MigrationFile allows attacker to upload files to any MigrationGitHub · Insecure Direct Object Reference · 2026 · High–92votes
- #3527771ValidAdd labels to arbitrary issues/prs & compromise github actions label checksGitHub · Insecure Direct Object Reference · 2026 · Medium–71votes
- #2210179ValidView Repo and Title of Any Private Check RunGitHub · Insecure Direct Object Reference · 2024–64votes
- #3527788ValidAdd labels to arbitrary issues/prs via Memex Bulk Update to compromise github actions label gatingGitHub · Insecure Direct Object Reference · 2026 · Medium–46votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.