Hackerone is not properly deleting user id Analysed #1133118 Valid Input Validation and Logic Medium 2021-06-11 – 356 Getting New Invitations without Leaving Programs Analysed #999789 Valid Input Validation and Logic Low 2020-10-15 – 322 adding h1_analyst_* to username for normal users Analysed #1770797 Valid Input Validation and Logic Low 2023-04-12 $500 187 Any user could upload attachments to pentest scoping form they don't have access to Analysed #2450215 Valid Input Validation and Logic High 2024-05-15 – 121 Account recovery text message is sending a wrong domain to users. Analysed #549364 Valid Input Validation and Logic Low 2019-05-31 – 117 @wearehackerone.com is vulnerable to namespace attacks due to hackerone.com not being RFC2142 compliant. Analysed #397792 Valid Input Validation and Logic Medium 2019-01-02 – 117 Harvesting all private invites using leave program fast-tracked invitation and security@ email forwarding feature Analysed #334205 Valid Input Validation and Logic Medium 2018-04-18 $2,500 103 Asset Inventory Internal Descriptions are leaked in CSV export Analysed #2011431 Valid Input Validation and Logic Medium 2023-07-12 – 76 Minor security issue with Hackerone Invitations from sandbox program Analysed #2430179 Valid Input Validation and Logic Low 2024-07-22 – 64 Email Forwarding invitations for Drafts are not marked as accepted, allowing multiple users to join a program after disabling Email Forwarding Analysed #331691 Valid Input Validation and Logic Low 2018-04-18 $500 54 Program managers can see draft reports using Export Reports feature Analysed #1664920 Valid Input Validation and Logic Low 2023-05-18 – 50 Response program can display "eligible for bounty" in scope area in program policy Analysed #475660 Valid Input Validation and Logic Low 2019-01-30 $500 47 Response program can create bounty table Analysed #460920 Valid Input Validation and Logic Low 2019-01-07 $500 46 API Last Request Date/Time Not Updating Analysed #220774 Valid Input Validation and Logic Low 2019-05-19 – 45 Ability to invite a new member on Sandbox Program Analysed #1088966 Valid Input Validation and Logic Low 2021-04-05 – 44 User's who are banned from program can still be invited to the new reports as collaborators Analysed #1131306 Valid Input Validation and Logic Low 2021-09-22 – 37 [Bypass] Ability to invite a new member in sandbox Organization Analysed #1486417 Valid Input Validation and Logic Medium 2022-04-14 – 35 Lack warning label when receiving a letter Analysed #1128701 Valid Input Validation and Logic Low 2021-05-13 – 33 A team member of the program with Report rights can ban the Admin Analysed #816143 Valid Input Validation and Logic Low 2020-05-15 – 30 Submitting report through Embedded Submission form gives user indefinite access to a profile Analysed #463828 Valid Input Validation and Logic Low 2019-01-03 $500 29