Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Confidential data of users and limited metadata of programs and reports accessible via GraphQLAnalysed#489146 | Valid | HackerOne | Information Disclosure | Critical | 2019-02-03 | – | 1,033 |
| Sensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameterAnalysed#542340 | Valid | Uber | Information Disclosure | High | 2019-09-09 | – | 643 |
| The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is presentAnalysed#3000510 | Valid | HackerOne | Information Disclosure | Critical | 2025-04-01 | – | 625 |
| Customer private program can disclose email any users through invited via usernameAnalysed#807448 | Valid | HackerOne | Information Disclosure | High | 2020-05-15 | $7,500 | 589 |
| Access to multiple production Grafana dashboardsAnalysed#663628 | Valid | Snapchat | Information Disclosure | High | 2020-11-04 | $10,000 | 464 |
| [Pre-Submission][H1-4420-2019] API access to Phabricator on code.uberinternal.com from leaked certificate in git repoAnalysed#591813 | Valid | Uber | Information Disclosure | Critical | 2021-02-25 | $40,000 | 458 |
| Open prod Jenkins instanceAnalysed#231460 | Valid | Snapchat | Information Disclosure | High | 2017-08-19 | $15,000 | 436 |
| An attacker can can view any hacker email via /SaveCollaboratorsMutation operation nameAnalysed#2032716 | Valid | HackerOne | Information Disclosure | High | 2023-07-04 | $12,500 | 429 |
| gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be readAnalysed#850447 | Valid | GitLab | Information Disclosure | Critical | 2020-06-08 | $10,000 | 410 |
| Employee's GitHub Token Found In Travis CI Build LogsAnalysed#496937 | Valid | Superhuman (formerly Grammarly) | Information Disclosure | High | 2019-05-22 | $5,000 | 408 |
| Physical Laptop TakeoverAnalysed#393615 | Valid | Ed | Information Disclosure | Critical | 2018-08-12 | – | 380 |
| JSON serialization of any Project model results in all Runner tokens being exposed through Quick ActionsAnalysed#509924 | Valid | GitLab | Information Disclosure | Critical | 2019-04-20 | $12,000 | 366 |
| Partial disclosure of report activity through new "Export as .zip" featureAnalysed#182358 | Valid | HackerOne | Information Disclosure | High | 2016-11-29 | $10,000 | 355 |
| Github information leakedAnalysed#676212 | Valid | Semrush | Information Disclosure | High | 2019-09-25 | – | 344 |
| Connection informaton is sent to a third-party service#752402 | No longer public | Nord Security | Information Disclosure | – | 2020-02-23 | – | 332 |
| AWS bucket leading to iOS test build code and configuration exposureAnalysed#404822 | Valid | Slack | Information Disclosure | Critical | 2019-02-23 | $1,500 | 321 |
| Information Disclosure in /skills callAnalysed#188719 | Valid | HackerOne | Information Disclosure | Medium | 2017-01-05 | $10,000 | 287 |
| Brave Browser Tor Window leaks user's real IP to the external DNS serverAnalysed#1077022 | Valid | Brave Software | Information Disclosure | High | 2021-06-17 | – | 280 |
| Exfiltrating a victim's exact location (to within 5m)Analysed#1234406 | Valid | Bumble | Information Disclosure | High | 2021-07-21 | – | 278 |
| Internal attachments can be exported via "Export as .zip" featureAnalysed#186230 | Valid | HackerOne | Information Disclosure | High | 2016-11-30 | $12,500 | 269 |
| OAuth `redirect_uri` bypass using IDN homograph attack resulting in user's access token leakageAnalysed#861940 | Valid | Semrush | Information Disclosure | Medium | 2020-06-18 | – | 265 |
| AWS keys and user cookie leakage via uninitialized memory leak in outdated librsvg version in BasecampAnalysed#2107680 | Valid | Basecamp | Information Disclosure | High | 2023-09-21 | $8,868 | 248 |
| Google API key leaked to PublicAnalysed#1065041 | Valid | FetLife | Information Disclosure | Low | 2021-01-23 | – | 228 |
| Public GitHub repositories for multiple HackerOne managed triage team profiles contain private HackerOne reports informationAnalysed#2937622 | Valid | HackerOne | Information Disclosure | Medium | 2025-05-31 | – | 226 |
| file read on MCS servers via supplying a QCOW2 image with external backing file#1024899 | No longer public | Mail.ru | Information Disclosure | – | 2021-03-19 | $15,000 | 222 |
| Google Docs link in JS files allows editing & reading survey informationAnalysed#2180521 | Valid | HackerOne | Information Disclosure | Medium | 2023-11-04 | – | 217 |
| Manipulate hacker profile and private program hacktivity to expose your name as researchers who is actively submitting reports with resolve statusAnalysed#654198 | Valid | HackerOne | Information Disclosure | Low | 2019-09-29 | $500 | 213 |
| Debug Mode Leak Critical Information [ AWS Keys , SMTP , Database , Django Secret Key ( RCE ) , Dodoc , Telegram , Twilio .. ]#1083543 | No longer public | Mail.ru | Information Disclosure | – | 2021-05-24 | – | 205 |
| Stealing Facebook OAuth Code Through Screenshot viewerAnalysed#488269 | Valid | Rockstar Games | Information Disclosure | Medium | 2019-03-05 | – | 200 |
| Blocked user can see live videoAnalysed#1067967 | Valid | TikTok | Information Disclosure | Medium | 2021-05-28 | $418 | 198 |
| sdrc.starbucks.com - Information Disclosure via unsecured attachment directoryAnalysed#769016 | Valid | Starbucks | Information Disclosure | Critical | 2020-02-26 | – | 197 |
| An invite-only's program submission state is accessible to users no longer part of the programAnalysed#800109 | Valid | HackerOne | Information Disclosure | Low | 2020-04-21 | $500 | 194 |
| Unauthorized access to metadata of undisclosed reports that were retestedAnalysed#871749 | Valid | HackerOne | Information Disclosure | Medium | 2020-06-05 | – | 189 |
| Chaining Bugs: Leakage of CSRF token which leads to Stored XSS and Account Takeover (xs1.tribalwars.cash)#604120 | No longer public | InnoGames | Information Disclosure | – | – | $1,100 | 186 |
| How The Hackers Saved ChristmasAnalysed#1069335 | Valid | h1-ctf | Information Disclosure | Critical | 2021-01-11 | – | 179 |
| Disclosure of `payment_transactions` for programs via GraphQL queryAnalysed#707433 | Valid | HackerOne | Information Disclosure | Medium | 2019-12-01 | – | 178 |
| Information Disclosure through Sentry Instance ███████Analysed#697512 | Valid | Eternal | Information Disclosure | High | 2019-09-19 | $750 | 178 |
| 404-response contains debug-information with all headersAnalysed#792998 | Valid | HackerOne | Information Disclosure | Low | 2020-05-16 | – | 173 |
| Total Paid Bounty Paid can be discloseAnalysed#674757 | Valid | HackerOne | Information Disclosure | Low | 2020-02-28 | $500 | 168 |
| Snippet JS template allows attacker to read a user's private snippetsAnalysed#348443 | Valid | GitLab | Information Disclosure | Low | 2019-03-03 | $300 | 165 |
| Cache Deception Allows Account TakeoverAnalysed#1698316 | Valid | Expedia Group Bug Bounty | Information Disclosure | High | 2023-04-01 | – | 160 |
| Information disclosure via a misconfigured third-party productAnalysed#739251 | Valid | Algolia | Information Disclosure | High | 2021-03-03 | – | 156 |
| Information disclosure with sensitive data#703600 | No longer public | Mail.ru | Information Disclosure | – | 2020-01-14 | $1,500 | 156 |
| Twitter ID exposure via error-based side-channel attackAnalysed#505424 | Valid | X / xAI | Information Disclosure | Medium | 2019-05-16 | $1,470 | 154 |
| Access to all files of remote user through shared fileAnalysed#258084 | Valid | Nextcloud | Information Disclosure | Medium | 2020-03-01 | – | 154 |
| Discrepancy in hacker profile report count may reveal existence of a private program by publishing a reportAnalysed#410015 | Valid | HackerOne | Information Disclosure | Medium | 2019-04-24 | $3,000 | 147 |
| Team object in GraphQL disclosed private_commentAnalysed#978143 | Valid | HackerOne | Information Disclosure | Medium | 2020-09-10 | $2,500 | 146 |
| information disclosure of secret_key_base via encoding charctersAnalysed#460545 | Valid | GitLab | Information Disclosure | High | 2019-06-13 | $3,500 | 146 |
| Internal logs/info leaked via endpoint {https://203.137.128.240/server-status}Analysed#2473173 | Valid | pixiv | Information Disclosure | High | 2026-01-20 | – | 145 |
| Leaking sensitive information on Github lead full access to all Grab Slack channelsAnalysed#397527 | Valid | Grab | Information Disclosure | Critical | 2018-09-11 | – | 145 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.