Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Maintainer can leak sentry token by changing the configured URL (fix bypass)Analysed#2104591	Valid	Information Disclosure	Medium	2024-10-08	–	32
Able to leak private email of any user given his/her username via graphqlAnalysed#972355	Valid	Information Disclosure	Medium	2021-01-08	–	29
Unauthorized access to private project security dashboardAnalysed#853355	Valid	Information Disclosure	Medium	2020-11-21	–	24
Unauthorized users may be able to view almost all informations related to Private projects.Analysed#407763	Valid	Information Disclosure	Medium	2018-12-03	–	24
GraphQL Query leads to sensitive information disclosure#985124	Duplicate	Information Disclosure	Medium	2021-03-08	–	12
Users can download old project exports due to unclaimed namespace#195058	Valid	Information Disclosure	Medium	2017-01-23	–	10
Todos are not redacted when membership changes - Access to (confidential) issues and merge requests#880863	Valid	Information Disclosure	Medium	2020-11-02	–	7
Use of Ruby Forwardable module and runtime meta-programming may introduce vulnerabilities#874401	Informative	Information Disclosure	Medium	2021-11-15	–	2

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.