Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Server Side Request Forgery (SSRF) via Analytics ReportsAnalysed#2262382	Valid	Server-Side Request Forgery	Critical	2023-12-08	$25,000	529
Customer private program can disclose email any users through invited via usernameAnalysed#807448	Valid	Information Disclosure	High	2020-05-15	$7,500	589
The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is presentAnalysed#3000510	Valid	Information Disclosure	Critical	2025-04-01	–	625
Email address of any user can be queried on Report Invitation GraphQL type when username is knownAnalysed#792927	Valid	Access Control	High	2020-02-20	–	671
WannaCrypt “Killswitch”Analysed#228648	Valid	No weakness recorded	–	2017-05-13	–	809
Confidential data of users and limited metadata of programs and reports accessible via GraphQLAnalysed#489146	Valid	Information Disclosure	Critical	2019-02-03	–	1,033
Account takeover via leaked session cookieAnalysed#745324	Valid	Authentication	High	2019-12-03	$20,000	1,642

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,686 analysed so far), which can be wrong. Data as of 2026-11-15.