Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| IDOR on GraphQL queries BillingDocumentDownload and BillDetailsAnalysed#2207248 | Valid | Insecure Direct Object Reference | Medium | 2024-02-08 | $5,000 | 187 |
| A staff member with no permissions can edit Store Customer EmailAnalysed#980511 | Valid | Insecure Direct Object Reference | Medium | 2020-10-22 | $1,500 | 72 |
| Low privileged user can create high privileged user's KITCRM authorization token and can read and write message to KITAnalysed#909863 | Valid | Insecure Direct Object Reference | Medium | 2021-02-07 | – | 38 |
| Replace other user files in Inbox messagesAnalysed#322661 | Valid | Insecure Direct Object Reference | Medium | 2018-05-01 | – | 38 |
| IDOR [partners.shopify.com] - User with ONLY Manage apps permission is able to get shops info and staff names from inside the shopAnalysed#243943 | Valid | Insecure Direct Object Reference | Medium | 2017-07-19 | $500 | 33 |
| Ability to generate shipping labels in another store ordersAnalysed#884159 | Valid | Insecure Direct Object Reference | – | 2020-08-19 | – | 26 |
| Access to Private Photos of Apps in App section(IDOR)Analysed#318751 | Valid | Insecure Direct Object Reference | Medium | 2018-03-05 | – | 20 |
| IDOR on stocky application-Low Stock-Varient-Settings-Columns#853130 | Valid | Insecure Direct Object Reference | Medium | 2020-07-14 | $750 | 13 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.