Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Password reset tokens sent to CSP reporting endpointsAnalysed#1626281 | Valid | Information Disclosure | Low | 2022-08-31 | – | 26 |
| Bitmoji source code is accessibleAnalysed#301812 | Valid | Information Disclosure | Medium | 2021-07-31 | $1,000 | 92 |
| Intent Leads To Unauthorised Video Call Initiation Leaking Surrounding Informations Of VictimAnalysed#2139260 | Valid | Information Disclosure | Medium | 2024-04-05 | – | 127 |
| Leaked JFrog Artifactory username and password exposed on GitHub - https://snapchat.jfrog.ioAnalysed#911606 | Valid | Information Disclosure | High | 2021-08-12 | $15,000 | 137 |
| Open prod Jenkins instanceAnalysed#231460 | Valid | Information Disclosure | High | 2017-08-19 | $15,000 | 436 |
| Access to multiple production Grafana dashboardsAnalysed#663628 | Valid | Information Disclosure | High | 2020-11-04 | $10,000 | 464 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.