Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| an xss issue in https://hunter22.slack.com/help/requests/793043#116419 | Valid | Cross-site Scripting | – | 2016-04-30 | $100 | 1 |
| Stored XSS in slack.com (integrations)#10297 | Valid | Cross-site Scripting | – | 2014-05-29 | – | 2 |
| Self-XSS in posts by formatting text as code#89505 | Valid | Cross-site Scripting | – | 2015-11-10 | – | 2 |
| Reflected Self-XSS in Slack#97683 | Valid | Cross-site Scripting | – | 2015-11-10 | – | 2 |
| Stored XSS in Channel Chat#2652 | Valid | Cross-site Scripting | – | 2014-05-21 | – | 3 |
| Reflective XSS can be triggered in IE#2497 | Valid | Cross-site Scripting | – | 2015-03-15 | $150 | 4 |
| Stored XSS in username.slack.com#2625 | Valid | Cross-site Scripting | – | 2014-08-07 | – | 4 |
| Reflected Xss#2777 | Valid | Cross-site Scripting | – | 2014-05-19 | $500 | 4 |
| Stored XSS#2926 | Valid | Cross-site Scripting | – | 2014-04-06 | – | 4 |
| Stored XSS in Slack (weird, trial and error)#96337 | Valid | Cross-site Scripting | – | 2015-11-10 | – | 4 |
| Executing scripts on slack-files.com using SVG#100565 | Valid | Cross-site Scripting | – | 2016-02-18 | – | 4 |
| Stored XSS in Slack.com#6002 | Valid | Cross-site Scripting | – | 2015-03-09 | – | 5 |
| Stored XSS on this link https://sehacure.slack.com/help/requests/#2639 | Valid | Cross-site Scripting | – | 2014-08-30 | – | 6 |
| a stored xss in slack integration https://onerror.slack.com/services/import#33018 | Valid | Cross-site Scripting | – | 2016-05-22 | $500 | 6 |
| Stored XSS in www.slack-files.com#2617 | Valid | Cross-site Scripting | – | 2014-05-23 | – | 8 |
| Stored XSS in Slackbot Direct Messages#4561 | Valid | Cross-site Scripting | – | 2014-05-04 | – | 8 |
| "a stored xss issue in share post menu"#148848 | Valid | Cross-site Scripting | – | 2017-06-25 | $500 | 8 |
| Stored XSS Found#9774 | Valid | Cross-site Scripting | – | 2014-06-01 | – | 9 |
| a stored xss issue in https://files.slack.com#149011 | Valid | Cross-site Scripting | – | 2017-06-25 | $500 | 9 |
| Open Redirect on slack.com#140447 | Valid | Cross-site Scripting | – | 2016-10-02 | $500 | 12 |
| dom xss in https://www.slackatwork.com#196624 | Valid | Cross-site Scripting | Low | 2017-03-02 | – | 13 |
| Bypass to postMessage origin validation via FTP#210654 | Valid | Cross-site Scripting | High | 2017-04-21 | – | 15 |
| Stored XSS in files.slack.comAnalysed#827606 | Valid | Cross-site Scripting | Medium | 2021-12-02 | – | 19 |
| Subdomain takeover on podcasts.slack-core.comAnalysed#195350 | Valid | Cross-site Scripting | Low | 2017-01-04 | $100 | 27 |
| Stored XSS(Cross Site Scripting) In Slack App NameAnalysed#159460 | Valid | Cross-site Scripting | – | 2016-11-22 | $1,000 | 29 |
| Store XSSAnalysed#187410 | Valid | Cross-site Scripting | High | 2017-01-01 | – | 44 |
| XSS on link and window.openerAnalysed#834071 | Valid | Cross-site Scripting | Medium | 2023-01-23 | $1,000 | 49 |
| The Custom Emoji Page has a Reflected XSSAnalysed#258198 | Valid | Cross-site Scripting | High | 2017-09-24 | – | 56 |
| Stored XSS through PDF viewerAnalysed#881557 | Valid | Cross-site Scripting | High | 2022-03-16 | $4,875 | 76 |
| Stored XSS on team.slack.com using new Markdown editor of posts inside the Editing mode and using javascript-URIsAnalysed#132104 | Valid | Cross-site Scripting | – | 2016-09-01 | – | 103 |
| XSS in gist integrationAnalysed#11073 | Valid | Cross-site Scripting | – | 2019-04-28 | $500 | 157 |
| XSS vulnerable parameter in a location hashAnalysed#146336 | Valid | Cross-site Scripting | – | 2019-10-16 | – | 455 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,614 analysed so far), which can be wrong. Data as of 2026-11-15.