Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
WeaknessInformation Disclosure
- Any class
- Cross-site Scripting1
- Cross-Site Request Forgery1
- Open Redirect1
- Command and Code Injection7
- Injection and Smuggling4
- Deserialization and Object Injection1
- Denial of Service1
- Input Validation and Logic1
- Misconfiguration and Insecure Design3
- Cryptography1
- Information Disclosure3
- Authentication1
- Access Control14
- Insecure Direct Object Reference6
- No weakness recorded2
3 of 15,219 reports · $4,000 in bounties · 161 analysed so far
- #2501036ValidAccess body and title of Internal Repo Issues in ProjectsGitHub · Information Disclosure · 2024 · Medium–100votes
- #2505761ValidInformation Leakage via Clicked Link in GitHub Repository (Fingerprinting)GitHub · Information Disclosure · 2024 · Medium$4,00072votes
- #3290630ValidSample report: Denial of serviceGitHub · Information Disclosure · 2025 · None–33votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.