Notification of previous signed out user leakage. #26395 Informative Information Disclosure – 2014-09-01 – 2 Requesting unknown file type returns Ruby object w/ address #109420 Valid Information Disclosure – 2016-02-19 – 2 Pending member invitations are not revoked on program name change #275293 Informative Information Disclosure – 2017-11-18 – 2 Internal bounty and swag details disclosed as part of JSON response #81083 Valid Information Disclosure – 2016-04-25 $500 3 Number of invited researchers disclosed as part of JSON search response #80597 Valid Information Disclosure – 2015-08-05 – 4 HackerOne Private Programs users disclosure and de-anonymous-ize #92716 Informative Information Disclosure – 2015-12-08 – 4 Distinguish EP+Private vs Private programs in HackerOne #118965 Valid Information Disclosure – 2016-04-25 – 4 Email Address Leak #123170 Duplicate Information Disclosure – 2016-03-31 – 4 Disclosure of private programs that have an "external" page on HackerOne #124611 Valid Information Disclosure – 2016-04-01 – 4 Reputation gain split by company can be used to track the existence of otherwise undisclosed reports #311449 N/A Information Disclosure – 2018-02-02 – 4 Minor Bug: Public un-compiled CSS with original sass, versioning, source map, comments, etc. #90367 Valid Information Disclosure – 2015-09-25 – 5 Minimum bounty of a private program is visible for users that were removed from the program #94336 Valid Information Disclosure – 2015-10-21 – 5 Private Program Disclosure in /:handle/settings/allow_report_submission.json endpoint #116798 Valid Information Disclosure – 2016-02-24 – 5 Information Disclosure which violate program privacy #313075 Informative Information Disclosure – 2018-02-20 – 5 Partial disclosure of undisclosed programs through <meta> tags #302620 Informative Information Disclosure – 2018-01-11 – 6 Deleted name still present via mouseover functionality for user accounts #127914 Valid Information Disclosure – 2016-04-21 – 7 Report title autocompletion #263 Valid Information Disclosure – 2015-06-08 – 8 Ability to see common response titles of other teams (limited) #31383 Valid Information Disclosure – 2014-10-15 – 8 Information leakage - Private reports cached by Google #80118 Informative Information Disclosure – 2018-07-23 – 8 Private Program all members disclosed #283309 Duplicate Information Disclosure – 2017-11-16 – 8 Leakage badges on disabled user #325594 Informative Information Disclosure – 2018-03-15 – 8 Information disclosure #350432 Duplicate Information Disclosure – 2018-12-27 – 8 "early preview" programs disclosure #29185 Informative Information Disclosure – 2015-01-21 – 9 Disclosure of external users invited to a specific report #157699 Valid Information Disclosure – 2016-09-01 – 9 Information disclosure via policy update notifications after removal from program #177484 Valid Information Disclosure – 2016-10-29 – 9 Search query text, including from potentially undisclosed reports, sent to Google Analytics on Inbox query page #280770 Valid Information Disclosure – 2017-11-01 – 9 Reward Money Leakage #149435 Informative Information Disclosure – 2016-08-09 – 10 No email verification on username change #29331 Valid Information Disclosure – 2014-11-17 $500 11 Verbose PHP error messages exposed on a blog article #439174 Valid Information Disclosure – 2019-04-10 – 11 CSS leaks SCSS debug info #2221 Valid Information Disclosure – 2014-02-28 – 13 Obtain the username & the uid of the one doing the S3 sync on Hackerone #173175 Valid Information Disclosure – 2016-10-03 – 14 Researcher gets email updates on a private program after he/she quits that program. #174449 Valid Information Disclosure – 2016-11-21 – 15 Lack of cross-origin request blocking allows leaking of sensitive information on several endpoints #350739 Duplicate Information Disclosure – 2018-06-07 – 15 Old titles are not hidden in reports with limited disclosure #144129 Valid Information Disclosure – 2016-06-21 – 16 Users contents on AWS is cacheable #163131 Valid Information Disclosure – 2016-09-06 – 16 Submitted reports state logs leakage #306733 Informative Information Disclosure – 2018-01-19 – 16 Invited team member can disclosure slack channels #509574 Valid Information Disclosure – 2019-04-05 $500 16 Hackers can reveal the names of private programs that have an external link #1127455 Informative Information Disclosure – 2021-08-24 – 16 Improper data update process on UpdatePhabricatorIntegration mutation leads to leak of Phabricator Conduit API token. #1161141 Informative Information Disclosure – 2021-04-30 – 16 PII data Leakage through hackerone reports #1256371 Valid Information Disclosure – 2021-08-09 – 16 File Name Enumeration #33935 Valid Information Disclosure – 2014-11-17 – 17 Private partial disclosure of h1 infrastructure #283361 Valid Information Disclosure – 2017-11-03 – 17 Know whether private program for company exist or not #105887 Valid Information Disclosure – 2016-01-15 – 18 Invalid Phabricator API token revealed through error message when escalating a report #335123 Valid Information Disclosure – 2018-06-27 $500 18 Exposing hackerone users personally identifiable information by abusing sandbox with swag reward enabled #357576 Informative Information Disclosure – 2018-06-07 – 18 Names not completely redacted despite "Redact the names of the involved users" is selected #2122644 Valid Information Disclosure Low 2023-08-29 $500 18 Used email confirmation link reveals the email address which is tied to it #1128358 Valid Information Disclosure – 2021-09-22 – 21 Users querying dim_hacker_reports table through Analytics API can determine data from dim_reports table using WHERE or HAVING query #1824342 Valid Information Disclosure Medium 2023-02-22 – 21 program_analytics_benchmarks query shows information not visible in public #826176 Valid Information Disclosure – 2020-03-27 – 22 Know undisclosed Bounty Amount when Bounty Statistics are enabled. #148050 Valid Information Disclosure – 2016-09-02 – 23