The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is present Analysed #3000510 Valid Information Disclosure Critical 2025-04-01 – 625 Public GitHub repositories for multiple HackerOne managed triage team profiles contain private HackerOne reports information Analysed #2937622 Valid Information Disclosure Medium 2025-05-31 – 226 Google Docs link in JS files allows editing & reading survey information Analysed #2180521 Valid Information Disclosure Medium 2023-11-04 – 217 Unauthorized access to metadata of undisclosed reports that were retested Analysed #871749 Valid Information Disclosure Medium 2020-06-05 – 189 Disclosure of `payment_transactions` for programs via GraphQL query Analysed #707433 Valid Information Disclosure Medium 2019-12-01 – 178 404-response contains debug-information with all headers Analysed #792998 Valid Information Disclosure Low 2020-05-16 – 173 Total Paid Bounty Paid can be disclose Analysed #674757 Valid Information Disclosure Low 2020-02-28 $500 168 Team object in GraphQL disclosed private_comment Analysed #978143 Valid Information Disclosure Medium 2020-09-10 $2,500 146 Unauthorized user can obtain `report_sources` attribute through Team GraphQL object Analysed #770209 Valid Information Disclosure Medium 2020-02-10 $2,500 142 Private program disclosure via `vpn_suspended` GraphQL query Analysed #715192 Valid Information Disclosure None 2019-10-21 $2,500 138 GraphQL field on Team node can be used to determine if External Program runs invite-only program Analysed #877642 Valid Information Disclosure Medium 2020-07-25 $2,500 107 New Hacktivity features:Bounty rewards leakage Where programs doesn’t decide to disclose bounty in limited disclosure report Analysed #2310620 Valid Information Disclosure Medium 2024-03-28 – 97 Team object in GraphQL disclosed total number of whitelisted hackers Analysed #342978 Valid Information Disclosure Medium 2018-05-12 $2,500 93 "Bounties paid in the last 90 days" discloses the undisclosed bounty amount in program statistics Analysed #696266 Valid Information Disclosure Low 2020-02-21 $500 86 HackerOne Undisclosed Report Leak via PoC of Full Disclosure on Hacktivity Analysed #1826141 Valid Information Disclosure Low 2023-02-10 $500 78 A HackerOne employee's GitHub personal access token exposed in Travis CI build logs Analysed #215625 Valid Information Disclosure Medium 2017-05-23 $2,000 75 Attachment object in GraphQL continues to grant access to files, even if they are removed from rendering Analysed #1132606 Valid Information Disclosure Medium 2021-08-24 – 66 Partial report contents leakage - via HTTP/2 concurrent stream handling Analysed #493176 Valid Information Disclosure Medium 2021-08-05 $2,500 64 Program metrics disclosed response_efficiency_percentage via /program_name json response despite the team decided not to show on their profile Analysed #347693 Valid Information Disclosure Medium 2018-05-08 $2,500 64 HackerOne customer submitted sensitive link to VirusTotal, exposing confidential information Analysed #378122 Valid Information Disclosure None 2018-07-26 – 60 Team object exposes amount of participants in a private program to non-invited users Analysed #380317 Valid Information Disclosure Medium 2018-07-20 – 59 HackerOne Staging uses Production data for testing Analysed #1392511 Valid Information Disclosure Low 2021-11-05 – 58 Total bounties paid amount is disclosed because of redesign of the Program Profiles Analysed #640488 Valid Information Disclosure Low 2019-08-02 – 50 Attachment in published HackerOne report exposure private program Analysed #1869613 Valid Information Disclosure Low 2023-06-07 – 49 information disclosure of another company bug on video. Analysed #1886143 Valid Information Disclosure Low 2023-03-12 – 47 Disclosure of the name of a program that has a private part with an external link Analysed #871142 Valid Information Disclosure Low 2020-05-22 $500 46 Hackers two email disclosed on submission at hackerone hactivity Analysed #2134874 Valid Information Disclosure – 2023-10-18 – 43 GraphQL node interface for ActiveResource models lacks encoding for resource identifier, enabling parameter injection in Payments backend Analysed #800231 Valid Information Disclosure Medium 2020-05-11 – 42 Invitation token leaks to https://bat.bing.com Analysed #301526 Valid Information Disclosure Low 2018-01-11 – 36 Information leakage of private program Analysed #159526 Valid Information Disclosure – 2016-08-18 $500 35 Private information exposed through GraphQL search endpoints aggregates Analysed #1838329 Valid Information Disclosure Medium 2023-01-19 – 32 Information disclosure - Feedback is accessible on Public profile even after 'disallowed' at https://hackerone.com/settings/feedback Analysed #1264725 Valid Information Disclosure Low 2021-08-03 – 30 Program profile metrics endpoint contains mean time to triage, even when turned off Analysed #289568 Valid Information Disclosure Medium 2017-11-14 – 29 Can read features from any user Analysed #316810 Valid Information Disclosure Medium 2018-03-12 $250 28 Program profile_metrics.json contains time to triage for deptofdefense even it's turned off Analysed #318399 Valid Information Disclosure None 2018-03-09 $250 27 Information Disclosure when /invitations/<token>.json is not yet accepted Analysed #290930 Valid Information Disclosure Medium 2019-12-06 – 25 resolved bugs in a program are public despite the program settings Analysed #270993 Valid Information Disclosure Low 2017-10-13 – 25 Know undisclosed Bounty Amount when Bounty Statistics are enabled. Analysed #148050 Valid Information Disclosure – 2016-09-02 – 23 Used email confirmation link reveals the email address which is tied to it Analysed #1128358 Valid Information Disclosure None 2021-09-22 – 21