Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
my.stripo.emai email verification bypassed and also create email templates#765318	Valid	Input Validation and Logic	Medium	2020-02-04	–	3
No rate limiting - Create Plug-ins#1047119	Valid	Input Validation and Logic	Medium	2021-01-05	–	7
No rate limiting for confirmation email lead to huge Mass mailings#1055503	Informative	Input Validation and Logic	Medium	2020-12-11	–	9
Ability to use premium templates as free user via https://stripo.email/templates/?utm_source=viewstripo&utm_medium=referralAnalysed#1166993	Valid	Input Validation and Logic	High	2022-03-30	–	15
No rate limit in email subscriptionAnalysed#1047124	Valid	Input Validation and Logic	Medium	2021-01-11	–	16
No rate limiting - Create dataAnalysed#1047100	Valid	Input Validation and Logic	Medium	2021-01-05	–	18
Bypass of #1047119: Missing Rate Limit while creating Plug-Ins at https://my.stripo.email/cabinet/plugins/Analysed#1076047	Valid	Input Validation and Logic	Medium	2021-01-13	–	19
Able to use 'PREMIUM TEMPLATES' in 'FREE PLAN' at [https://my.stripo.email/cabinet/#/my-templates/]Analysed#1009046	Valid	Input Validation and Logic	High	2021-01-25	–	51
No rate limiting for subscribe email + lead to Cross origin misconfigurationAnalysed#1029723	Valid	Input Validation and Logic	Medium	2020-11-30	–	54

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.