Disclosed bug bounty reports

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
User Information sent to client through websockets#168223	Informative	Information Disclosure	–	2016-12-07	–	1
CSRF with redeem coupon request#148417	Informative	Cross-Site Request Forgery	–	2016-08-13	–	2
Missing rel=noreferrer tag allows link in list to change url of currently open tab#158002	Valid	Misconfiguration and Insecure Design	–	2016-09-12	–	4
Image Upload Path Disclosure#158021	Valid	Information Disclosure	–	2016-09-12	$100	5
API OAuth Public Key disclosure in mobile app#160120	Informative	Information Disclosure	–	2016-09-15	–	5
Seemingly sensitive information at /api/v2/zones#165131	Valid	Information Disclosure	–	2016-11-16	$50	5
Fetch private list metadata and any user's personal name#162822	Valid	Information Disclosure	–	2016-09-12	$150	6
Access private list metadata#178506	Valid	Information Disclosure	–	2016-12-24	$100	6
Reflected File Download on recipe list search#158505	Informative	Command and Code Injection	–	2016-10-18	–	7
READ .svg files by changing .svg into .png extension#161301	Valid	Misconfiguration and Insecure Design	–	2017-03-29	–	7
CSRF To change Email Notification Settings#157956	Valid	Cross-Site Request Forgery	–	2016-09-15	–	8
WordPress Authentication Denial of Service#163307	Valid	Denial of Service	–	2017-05-26	$100	8
shopper login_code's can be brute forced#158157	Valid	Authentication	–	2016-09-17	–	9
Authentication Bypass in Updating Personal Information#146129	Informative	Authentication	–	2017-01-17	–	10
Issues with uploading list images#159820	Valid	Denial of Service	–	2016-09-26	–	11
Brute force login and bypass locked account restrictions via iOS app#160109	Valid	Misconfiguration and Insecure Design	–	2016-09-19	–	11
[Critical] Subdomain Takeover#163790	N/A	Access Control	–	2016-09-20	–	13
Full access to any list#173969	Valid	Access Control	–	2016-11-18	$150	13
Hyperlink Injection in Friend Invitation Emails#158554	Valid	Open Redirect	–	2016-09-12	$100	14
Bruteforcing password reset tokens, could lead to account takeover#271533	Valid	Authentication	–	2017-11-06	$50	14
XSS in instacart.com/store/partner_recipe#196221	Valid	Cross-site Scripting	–	2017-05-11	$100	15
Login with Google Not Authenticated on iOS App#202177	Valid	Authentication	–	2017-05-21	–	15
Cookie-Based Injection#105419	Valid	Cross-site Scripting	–	2016-09-26	–	16
Get all instacart emails - missing rate limit on /accounts/register#275186	Valid	No weakness recorded	–	2017-12-01	$150	16
Stored XSS#157958	Valid	Cross-site Scripting	–	2016-09-09	–	17
Host Header Injection/Redirection in: https://www.instacart.com/#158019	Valid	Open Redirect	–	2016-09-11	–	17
XSS at in instacart.com/store/partner_recipe#227809	Valid	Cross-site Scripting	–	2017-05-30	–	18
Cross-Site Scripting Reflected On Main Domain#104917	Valid	Cross-site Scripting	–	2016-09-30	–	19
Reverse Tab-nabbing at www.instacart.com/store/partner_recipe?recipe_url=#227833	Valid	No weakness recorded	–	2017-05-30	–	19
View & add to cart unlisted items via IDOR#344284	Valid	Insecure Direct Object Reference	–	2018-05-25	–	19
Server side request forgery on image upload for lists#158016	Valid	Command and Code Injection	–	2016-10-12	$50	21
Cross-Site Request Forgery (CSRF)#157993	Valid	Cross-Site Request Forgery	–	2016-10-13	–	33
Authorization Bypass in Delivery Chat Logs#144000	Valid	Access Control	–	2016-11-03	$100	35
Race Condition in Redeeming Coupons#157996	Valid	Misconfiguration and Insecure Design	–	2016-09-12	–	43
CSRF Trial 14 days express subscription#334139	Valid	Cross-Site Request Forgery	–	2019-02-27	–	59

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.