Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
AWS bucket leading to iOS test build code and configuration exposureAnalysed#404822	Valid	Information Disclosure	Critical	2019-02-23	$1,500	321
Unauthenticated LFI revealing log informationAnalysed#272578	Valid	Information Disclosure	High	2018-01-26	–	123
SSRF via Office file thumbnailsAnalysed#671935	Valid	Information Disclosure	Critical	2022-07-05	$4,000	109
Real Time Error Logs Through Debug InformationAnalysed#503283	Valid	Information Disclosure	High	2019-04-11	–	100
Slack-Corp Heroku application disclosing limited info about company membersAnalysed#966814	Valid	Information Disclosure	Low	2020-12-09	–	39
Workspace configuration metadata disclosureAnalysed#864489	Valid	Information Disclosure	High	2022-04-01	–	39
Private application files can be uploaded to Slack via malicious uploaderAnalysed#375083	Valid	Information Disclosure	Medium	2021-08-04	$500	38
Information Disclosure on stun.screenhero.com#175061	Valid	Information Disclosure	Medium	2016-11-30	$700	14
Email enumeration#2766	Informative	Information Disclosure	–	2014-04-02	–	8
Session Fixation disclosing email address#2582	Informative	Information Disclosure	–	2014-03-31	–	7
Email information leakage for certain addresses#169992	Valid	Information Disclosure	–	2016-10-31	$400	5

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.