Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Sensitive Information disclosure Through Config File#775123	Duplicate	Information Disclosure	–	2020-07-24	–	1
There is any issue No valid SPF Records#864696	Duplicate	Authentication	None	2020-07-24	–	1
csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC#995699	Duplicate	Memory Corruption	Medium	2021-01-07	–	1
exposed Git Repo at http://api.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.io/.git/#970520	Duplicate	Information Disclosure	High	2021-01-07	–	2
Fake email from <any_name>@kubernetes.io to any other email#918243	Duplicate	No weakness recorded	None	2020-07-24	–	3
Unsecured Grafana instance on https://monitoring.prow-canary.k8s.io/dashboards#1000922	Duplicate	Authentication	High	2021-01-07	–	4
Route53 Subdomain Takeover on test-cncf-aws.canary.k8s.io#794382	Duplicate	Misconfiguration and Insecure Design	High	2021-01-16	–	13
Development Application Credentials + Information Exposed#1018413	Duplicate	Cryptography	High	2020-12-03	–	31

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.