Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| protected Tweet settings overwritten by other settingsAnalysed#664038 | Valid | No weakness recorded | – | 2020-01-01 | – | 178 |
| Verify any unused email addressAnalysed#574962 | Valid | Access Control | – | 2019-06-24 | $560 | 197 |
| XSS and cache poisoning via upload.twitter.com on ton.twitter.comAnalysed#84601 | Valid | Cross-site Scripting | – | 2019-05-01 | – | 198 |
| Stored XSS on reports.Analysed#485748 | Valid | Cross-site Scripting | – | 2019-04-01 | $700 | 232 |
| XSS via Direct Message deeplinksAnalysed#341908 | Valid | Cross-site Scripting | – | 2019-05-09 | – | 236 |
| Bypass Password Authentication for updating email and phone number - Security VulnerabilityAnalysed#770504 | Valid | Authentication | – | 2020-02-08 | – | 288 |
| Private list members disclosure via GraphQLAnalysed#885539 | Valid | Access Control | – | 2020-08-04 | – | 346 |
| Read-only application can publish/delete fleetsAnalysed#1032468 | Valid | Access Control | – | 2021-01-04 | – | 398 |
| Bypassing Digits origin validation which leads to account takeoverAnalysed#129873 | Valid | Authentication | – | 2020-06-24 | – | 619 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.