Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| iframes considered harmful#55827 | Informative | Misconfiguration and Insecure Design | – | 2015-12-01 | – | 1 |
| SPF records not found#92740 | Valid | Misconfiguration and Insecure Design | – | 2015-10-14 | – | 1 |
| Credit Card Validation Issue#29234 | Valid | No weakness recorded | – | 2015-03-12 | – | 2 |
| Invoice Details activate JS that filled in#21034 | Valid | Cross-site Scripting | – | 2015-03-30 | – | 3 |
| New Device Confirmation, token is valid until not used.#36594 | Valid | Cryptography | – | 2015-05-24 | – | 3 |
| Sandboxed iframes don't show confirmation screen#54733 | Valid | Misconfiguration and Insecure Design | – | 2015-04-04 | – | 3 |
| XXE in OAuth2 Applications gallery profile App logo#104620 | Informative | No weakness recorded | – | 2015-12-16 | – | 3 |
| open authentication bug#48065 | Valid | Authentication | – | 2015-03-11 | – | 4 |
| New Device confirmation tokens are not properly validated.#30238 | Valid | Authentication | – | 2015-05-25 | $100 | 5 |
| Two-factor authentication (via SMS)#66223 | Informative | Authentication | – | 2015-06-16 | – | 5 |
| OAUTH pemission set as true= lead to authorize malicious application#87561 | Valid | Authentication | – | 2015-12-01 | $100 | 5 |
| User email enumuration using Gmail#90308 | Valid | Information Disclosure | – | 2015-12-23 | – | 6 |
| Transactions visible on Unconfirmed devices#100186 | Valid | Authentication | – | 2015-12-11 | $500 | 8 |
| Stored-XSS in https://www.coinbase.com/#100829 | Valid | Cross-site Scripting | – | 2015-12-07 | – | 13 |
| HTML injection in apps user reviewAnalysed#104543 | Valid | No weakness recorded | – | 2015-12-21 | $200 | 31 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.