Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Reflected XSS on www.hackerone.com and resources.hackerone.comAnalysed#840759 | Valid | Cross-site Scripting | Low | 2020-05-05 | $500 | 387 |
| Cross-site Scripting (XSS) on HackerOne careers pageAnalysed#474656 | Valid | Cross-site Scripting | Low | 2019-02-17 | $500 | 239 |
| Reflected XSS on www.hackerone.com via Wistia embed codeAnalysed#986386 | Valid | Cross-site Scripting | Low | 2020-09-24 | $500 | 236 |
| DOM Based XSS in www.hackerone.com via PostMessageAnalysed#398054 | Valid | Cross-site Scripting | Low | 2019-02-21 | $500 | 208 |
| RXSS at image.hackerone.live via the `url` parameterAnalysed#2035332 | Valid | Cross-site Scripting | Low | 2023-08-11 | $500 | 171 |
| Content spoofing and potential Cross-Site Scripting vulnerability on www.hackerone.comAnalysed#374919 | Valid | Cross-site Scripting | Medium | 2018-08-04 | – | 129 |
| Stored XSS on www.hackerone.com due to deleted S3-bucket from old page_widgetAnalysed#1598347 | Valid | Cross-site Scripting | Medium | 2023-03-10 | – | 122 |
| DOM Based XSS in www.hackerone.com via PostMessage (bypass of #398054)Analysed#499030 | Valid | Cross-site Scripting | Low | 2019-05-04 | – | 106 |
| Bypass of #2035332 RXSS at image.hackerone.live via the `url` parameterAnalysed#2106708 | Valid | Cross-site Scripting | Low | 2023-08-22 | – | 80 |
| Query parameter reordering causes redirect page to render unsafe URLAnalysed#293689 | Valid | Cross-site Scripting | Medium | 2017-11-30 | $1,500 | 61 |
| (HackerOne SSO-SAML) Login CSRF, Open Redirect, and Self-XSS Possible ExploitationAnalysed#171398 | Valid | Cross-site Scripting | Low | 2016-10-27 | – | 44 |
| CSP not consistently appliedAnalysed#321 | Valid | Cross-site Scripting | – | 2013-11-30 | – | 34 |
| Self DOM-Based XSS in www.hackerone.comAnalysed#406587 | Valid | Cross-site Scripting | Low | 2018-11-08 | – | 23 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.