Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Full access to InDrive jira panel via exposed API tokenAnalysed#1785145 | Valid | Information Disclosure | Critical | 2023-06-28 | – | 125 |
| # Drivers can access the customers phone number, current location without getting their offer accepted!Analysed#1785079 | Valid | Information Disclosure | Medium | 2024-02-19 | – | 79 |
| Disclosure of users' ip address whenever they view my fright offer on image preview (Without interaction)Analysed#1782467 | Valid | Information Disclosure | Medium | 2024-02-19 | – | 73 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.