Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
StatusAny
WeaknessInput Validation and Logic
- Any class
- Cross-site Scripting57
- Cross-Site Request Forgery6
- Open Redirect5
- Server-Side Request Forgery18
- SQL Injection1
- Command and Code Injection18
- Injection and Smuggling4
- File and Path Handling5
- Memory Corruption1
- Denial of Service14
- Input Validation and Logic7
- Misconfiguration and Insecure Design15
- Information Disclosure32
- Authentication9
- Access Control52
- Insecure Direct Object Reference12
- No weakness recorded1
Access (analysis)Any
TechniqueAny
7 of 15,219 reports · $13,750 in bounties · 227 analysed so far
- #409395ValidAnalysedBypass of GitLab CI runner slash fix in YAML validationGitLab · Input Validation and Logic · 2019 · needs: a user account · Path traversal, Business logic flaw–363votes
- #894569ValidAnalysedAn attacker can run pipeline jobs as arbitrary userGitLab · Input Validation and Logic · 2020 · needs: a user account · Privilege escalation, Business logic flaw$12,000307votes
- #565883ValidAnalysedBypass Email Verification -- Able to Access Internal Gitlab Services that use Login with Gitlab and Perform Check on email domainGitLab · Input Validation and Logic · 2019 · needs: a user account · E-mail verification bypass, Authentication bypass–249votes
- #312118ValidUsing GitLab to monitor and hijack domains in mass quantity.GitLab · Input Validation and Logic · 2018$75039votes
- #462503ValidClaiming package names in GitLab's automatic package referencer.GitLab · Input Validation and Logic · 2019$1,00026votes
- #882848ValidPossibilty to purchase Ultimate - 1 Year (EDU or OSS)GitLab · Input Validation and Logic · 2020–23votes
- #296907InformativeLack of validation before assigning custom domain names leading to abuse of GitLab pages serviceGitLab · Input Validation and Logic · 2018–2votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.