Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Open redirection in https://zeit.co/login?next=#618214 | No longer public | Open Redirect | – | – | – | 7 |
| [Fix Bypass #541631] Open redirect on Signup#541948 | No longer public | Open Redirect | – | – | – | 9 |
| Open Redirect on Gitllab Oauth leading to Acount Takeover#677617 | No longer public | Open Redirect | – | – | – | 34 |
| through %09 Character the attacker is able to steal Github Token [ Account Takeover ]#763058 | No longer public | Open Redirect | – | – | – | 44 |
| Open redirect vuln on login#608031 | No longer public | Open Redirect | – | – | – | 45 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.