Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Race condition in performing retest allows duplicated paymentsAnalysed#429026 | Valid | Race Conditions | Medium | 2018-12-27 | – | 240 |
| Race Condition leads to undeletable group memberAnalysed#604534 | Valid | Race Conditions | Low | 2020-03-20 | – | 153 |
| Race Condition in Flag SubmissionAnalysed#454949 | Valid | Race Conditions | Low | 2019-07-22 | – | 94 |
| Race condition in joining CTF groupAnalysed#1540969 | Valid | Race Conditions | Low | 2023-01-08 | $500 | 72 |
| Race condition in claiming program credentialsAnalysed#488985 | Valid | Race Conditions | Low | 2019-05-19 | – | 54 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.