Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Email information leakage for certain addresses#169992	Valid	Information Disclosure	–	2016-10-31	$400	5
Session Fixation disclosing email address#2582	Informative	Information Disclosure	–	2014-03-31	–	7
Email enumeration#2766	Informative	Information Disclosure	–	2014-04-02	–	8
Information Disclosure on stun.screenhero.com#175061	Valid	Information Disclosure	Medium	2016-11-30	$700	14
Private application files can be uploaded to Slack via malicious uploaderAnalysed#375083	Valid	Information Disclosure	Medium	2021-08-04	$500	38
Workspace configuration metadata disclosureAnalysed#864489	Valid	Information Disclosure	High	2022-04-01	–	39
Slack-Corp Heroku application disclosing limited info about company membersAnalysed#966814	Valid	Information Disclosure	Low	2020-12-09	–	39
Real Time Error Logs Through Debug InformationAnalysed#503283	Valid	Information Disclosure	High	2019-04-11	–	100
SSRF via Office file thumbnailsAnalysed#671935	Valid	Information Disclosure	Critical	2022-07-05	$4,000	109
Unauthenticated LFI revealing log informationAnalysed#272578	Valid	Information Disclosure	High	2018-01-26	–	123
AWS bucket leading to iOS test build code and configuration exposureAnalysed#404822	Valid	Information Disclosure	Critical	2019-02-23	$1,500	321

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,686 analysed so far), which can be wrong. Data as of 2026-11-15.