Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Client-Side Race Condition using Marketo, allows sending user to data-protocol in Safari when form without onSuccess is submitted on www.hackerone.comAnalysed#381356 | Valid | Input Validation and Logic | Low | 2019-04-05 | – | 154 |
| Improper UUID validation results in bypass of #419896Analysed#423073 | Valid | Input Validation and Logic | High | 2018-10-25 | – | 82 |
| Residual Malicious Payloads on HackerOne after Vulnerability FixesAnalysed#3168691 | Valid | Input Validation and Logic | Medium | 2026-04-16 | – | 72 |
| Changing Victim's JIRA Integration Settings Through Multiple BugsAnalysed#226199 | Valid | Input Validation and Logic | Medium | 2017-05-23 | $1,000 | 36 |
| Dangling cloud instance at vpn.inverselink.comAnalysed#1112679 | Valid | Input Validation and Logic | Low | 2021-03-11 | $500 | 29 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.