Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Open Redirect at https://oauth.secure.pixiv.netAnalysed#972601 | Valid | Open Redirect | Low | 2020-12-22 | $200 | 29 |
| XSS Reflected at https://sketch.pixiv.net/ Via `next_url`Analysed#1503601 | Valid | Cross-site Scripting | Medium | 2022-03-23 | – | 64 |
| clickjacing can lead to account takeoverAnalysed#2119892 | Valid | Misconfiguration and Insecure Design | Low | 2026-01-18 | $200 | 70 |
| XSS reflected on [https://www.pixiv.net]Analysed#766633 | Valid | Cross-site Scripting | Medium | 2020-12-17 | $500 | 144 |
| Internal logs/info leaked via endpoint {https://203.137.128.240/server-status}Analysed#2473173 | Valid | Information Disclosure | High | 2026-01-20 | – | 145 |
| Stealing Users OAuth authorization code via redirect_uriAnalysed#1861974 | Valid | Access Control | High | 2023-03-22 | $2,000 | 253 |
| Reset any passwordAnalysed#703972 | Valid | Authentication | High | 2021-03-31 | – | 313 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,437 analysed so far), which can be wrong. Data as of 2026-11-15.