Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| SQL Injection Extracts Starbucks Enterprise Accounting, Financial, Payroll DatabaseAnalysed#531051 | Valid | SQL Injection | – | 2019-08-06 | – | 801 |
| Blind SQLi leading to RCE, from Unauthenticated access to a test API WebserviceAnalysed#592400 | Valid | SQL Injection | – | 2019-07-22 | – | 236 |
| Blind SQL Injection on starbucks.com.gt and WAF Bypass :*Analysed#549355 | Valid | SQL Injection | – | 2019-06-19 | – | 210 |
| Time-based Blind SQLi on news.starbucks.com#198292 | Valid | SQL Injection | – | 2017-02-24 | – | 35 |
| SQL injection in partner id field on https://www.teavana.com (Sign-up form)#269279 | Valid | SQL Injection | – | 2018-01-23 | – | 27 |
| SQL Injection Proof of Concept for Starbucks URL#360539 | N/A | SQL Injection | – | 2019-01-09 | – | 2 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.