Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| exposure of personal IP address via email.Analysed#3179850 | Valid | Information Disclosure | – | 2025-07-16 | – | 61 |
| API token sent to URL dictated by an untrusted project .weblate fileAnalysed#3825141 | Valid | Information Disclosure | Medium | 2026-09-04 | – | 27 |
| HTML injection and information disclosure in support panelAnalysed#634312 | Valid | Information Disclosure | Medium | 2019-07-09 | – | 20 |
| wlc: Project-wide download fails part-way and leaves stale archives on disk; filesystem errors surface as raw Python tracebacks.Analysed#4040149 | Valid | Information Disclosure | Low | 2026-10-30 | – | 14 |
| Browser Self XSS Protection not implemented#400781 | Valid | Information Disclosure | – | 2018-09-26 | – | 7 |
| Information Disclosure on demo.weblate.org#229620 | Valid | Information Disclosure | Low | 2017-06-02 | – | 7 |
| Secret_key in GitHub#926093 | Informative | Information Disclosure | None | 2020-07-18 | – | 6 |
| Open port leads to information disclosure#223421 | Informative | Information Disclosure | Low | 2018-09-10 | – | 5 |
| Already Registered Email Disclosure#223343 | Valid | Information Disclosure | Low | 2017-05-17 | – | 3 |
| DNSSEC Zone Walk using NSEC Records#228471 | Informative | Information Disclosure | None | 2018-01-30 | – | 1 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.