Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| RXSS in https://store.oppomobile.com/#869870 | Not checked yet | Cross-site Scripting | – | – | $100 | 10 |
| No rate limit on Reporting a Threat on [https://community.coloros.com] lead to Increase in the User Group/Points#887684 | Not checked yet | Input Validation and Logic | – | – | $100 | 14 |
| Information Disclosure at https://portal.finzfin.com/1.txt#1011073 | Not checked yet | Information Disclosure | – | – | $50 | 20 |
| Arbitrary thread deletion on c.realme.com#869705 | Not checked yet | Insecure Direct Object Reference | – | – | $600 | 73 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.