Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Responsible disclosure - public S3 bucket exposing JSON/config filesAnalysed#3382796 | Valid | Information Disclosure | Low | 2025-11-14 | – | 36 |
| GitHub Retired UsernameTakeover From [aws/████████]Analysed#3478646 | Valid | Supply Chain and Malicious Code | Low | 2026-08-03 | – | 48 |
| AWS | Self Registration Internal LibreChat : Access to internal/proprietary LLMsAnalysed#3287396 | Valid | Authentication | Low | 2025-08-25 | – | 61 |
| Unlimited Reuse of Coupon Code Allows Free Shipping on All Orders on ██████████Analysed#3426839 | Valid | Input Validation and Logic | Low | 2026-02-09 | – | 69 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,942 analysed so far), which can be wrong. Data as of 2026-11-15.