Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| User can link non-public file attachments, leading to file disclose on edit by higher-privileged userAnalysed#763177 | Valid | Input Validation and Logic | Medium | 2022-06-26 | $500 | 20 |
| Markdown parsing issue enables insertion of malicious tagsAnalysed#758002 | Valid | Cross-site Scripting | – | 2019-12-13 | – | 21 |
| Broken Authentication and Session ManagementAnalysed#17474 | Valid | Authentication | – | 2014-08-05 | – | 26 |
| IDOR bug to See hidden slowvote of any user even when you dont have access rightAnalysed#661978 | Valid | Insecure Direct Object Reference | – | 2019-08-29 | $300 | 36 |
| Command injection on Phabricator instance with an evil hg branch nameAnalysed#288704 | Valid | Command and Code Injection | Critical | 2017-11-11 | – | 41 |
| Git flag injection leads to arbitrary file writeAnalysed#1070247 | Valid | File and Path Handling | High | 2021-07-25 | – | 54 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.