Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
ImageMagick GIF coder vulnerability leading to memory disclosureAnalysed#315256	Valid	Information Disclosure	Medium	2018-07-02	–	86
Big Picture web browser leaks login cookies and discloses sensitive information (may lead to account takeover)Analysed#1079561	Valid	Information Disclosure	High	2021-09-21	–	60
https://srcds.valve.net/find/ is leaking server config / API keysAnalysed#1168557	Valid	Information Disclosure	High	2024-08-06	–	56
Hidden scheduled partner events are propagated to Steam clients in CMsgClientClanStateAnalysed#780167	Valid	Information Disclosure	Medium	2020-03-20	–	31
GetReports works for hubs you don't have access toAnalysed#350937	Valid	Information Disclosure	Medium	2018-05-30	$750	24
GetGlobalAchievementPercentagesForApp is missing the same release checks as GetSchemaForGameAnalysed#541020	Valid	Information Disclosure	Medium	2020-02-19	–	22
Aapp name leakage on economy history pageAnalysed#349681	Valid	Information Disclosure	Medium	2018-05-24	–	16
ajaxgetachievementsforgame is not guarded for unreleased appsAnalysed#835087	Valid	Information Disclosure	Medium	2020-07-30	$750	14

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.