Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Privilege Escalation leads to trash other users comment without having admin rights.#1307943	Valid	Access Control	Low	2021-12-01	–	9
Login session not expireAnalysed#1294231	Valid	Authentication	Low	2021-08-10	$100	18
RCE via exposed JMX server on jabber.37signals.com/jabber.basecamp.comAnalysed#1456063	Valid	Deserialization and Object Injection	Low	2022-04-26	$100	30
Information Disclosure of Garbage Collection CycleAnalysed#981796	Valid	Information Disclosure	Low	2020-11-04	–	33
Information Disclosure of Garbage Collection Cycle 'Again'Analysed#1026196	Valid	Information Disclosure	Low	2020-12-16	$100	41
Error Page Content Spoofing or Text InjectionAnalysed#1245051	Valid	Misconfiguration and Insecure Design	Low	2021-07-14	$100	45
Domain Takeover [3737signals.com]Analysed#1253926	Valid	Input Validation and Logic	Low	2021-08-13	–	48
Password reset link not expiring after changing password in settingsAnalysed#1288898	Valid	Authentication	Low	2021-08-10	$250	49
Improper Access Control in `fizzy.do` import flow allows cross-tenant ActionText reference resolution and data disclosureAnalysed#3543475	Valid	Access Control	Low	2026-04-14	–	53
Information Disclosure .htaccess accesible for publicAnalysed#1241849	Valid	No weakness recorded	Low	2021-07-18	–	76
Unauthenticated access to private files on app.fizzy.do via Active Storage URLs leads to information disclosureAnalysed#3467641	Valid	Insecure Direct Object Reference	Low	2026-03-16	$100	76
Stored XSS on Trix Editor version latest (2.1.16) - Sanitizer BypassAnalysed#3581911	Valid	Cross-site Scripting	Low	2026-07-14	$337	89
Spam & Clearance checks disabled with existing referenced Message-IDAnalysed#2012659	Valid	Access Control	Low	2026-01-21	$250	123

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.