Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Sensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameterAnalysed#542340	Valid	Information Disclosure	High	2019-09-09	–	643
[Pre-Submission][H1-4420-2019] API access to Phabricator on code.uberinternal.com from leaked certificate in git repoAnalysed#591813	Valid	Information Disclosure	Critical	2021-02-25	$40,000	458
ubernycmarketplace.com is vulnerable to the Heartbleed BugAnalysed#304190	Valid	Information Disclosure	Low	2020-04-23	$1,500	112
Open AWS S3 bucket at ubergreece.s3.amazonaws.com exposes confidential internal documents and filesAnalysed#361438	Valid	Information Disclosure	Low	2021-03-12	$500	70
phone number exposure for riders/drivers given email/uuidAnalysed#225243	Valid	Information Disclosure	Medium	2017-06-02	–	36
Uber employees are sharing information on productforums.google.comAnalysed#344086	Valid	Information Disclosure	High	2021-02-25	–	16
Exposed Golang Pprof debugger at https://cn-geo1.uber.com/Analysed#1385906	Valid	Information Disclosure	Low	2022-04-07	–	14
Full path disclosure on track.uber.comAnalysed#125197	Valid	Information Disclosure	Low	2018-11-20	$100	14

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.