Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Race condition in endpoint POST fetlife.com/users/invitation, allow attacker to generate unlimited invitesAnalysed#1460373	Valid	No weakness recorded	Medium	2022-03-09	–	30
Able to detect if a user is FetLife supporter although this user hides their support badge in fetlife.com/conversations/{id} JSON responseAnalysed#1423704	Valid	Information Disclosure	Medium	2022-02-11	–	34
Specific Payload makes a Users Posts unavailableAnalysed#1176794	Valid	Denial of Service	Medium	2022-01-26	$100	49
Able to see location coordinates in any event without permission to do soAnalysed#2610467	Valid	Information Disclosure	Low	2024-09-25	–	62
Able to access private picture/video/writing when requesting for their JSON responseAnalysed#1424291	Valid	Information Disclosure	Medium	2021-12-16	–	73
Stored XSS via Angular Expression injection via Subject while starting conversation with other users.Analysed#1095934	Valid	Cross-site Scripting	Medium	2021-03-07	–	82
Stored XSS via `Create a Fetish` section.Analysed#1085914	Valid	Cross-site Scripting	Medium	2021-02-25	–	98
Google API key leaked to PublicAnalysed#1065041	Valid	Information Disclosure	Low	2021-01-23	–	228

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.