Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Race condition in endpoint POST fetlife.com/users/invitation, allow attacker to generate unlimited invites#1460373	Valid	No weakness recorded	–	2022-03-09	–	30
Able to detect if a user is FetLife supporter although this user hides their support badge in fetlife.com/conversations/{id} JSON response#1423704	Valid	Information Disclosure	–	2022-02-11	–	34
Able to see highest poll result without voting or view result#2248116	Informative	Information Disclosure	Low	2023-11-15	–	44
Specific Payload makes a Users Posts unavailable#1176794	Valid	Denial of Service	–	2022-01-26	$100	49
Able to see location coordinates in any event without permission to do so#2610467	Valid	Information Disclosure	Low	2024-09-25	–	62
Able to access private picture/video/writing when requesting for their JSON response#1424291	Valid	Information Disclosure	–	2021-12-16	–	73
Stored XSS via Angular Expression injection via Subject while starting conversation with other users.#1095934	Valid	Cross-site Scripting	–	2021-03-07	–	82
fetlife.com/signup_step_profile expose access_token of mapbox.com#2129769	Informative	Cryptography	Medium	2023-11-01	–	87
Stored XSS via `Create a Fetish` section.#1085914	Valid	Cross-site Scripting	–	2021-02-25	–	98
Google API key leaked to PublicAnalysed#1065041	Valid	Information Disclosure	–	2021-01-23	–	228

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.