Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Private invitation links/tokens leak to third-party analytics siteAnalysed#1491127 | Valid | Information Disclosure | Low | 2022-04-05 | $500 | 28 |
| Attachment references in markdown don't warn before downloadingAnalysed#1386277 | Valid | Open Redirect | Low | 2022-02-25 | – | 29 |
| Ability to escape database transaction through SQL injection, leading to arbitrary code executionAnalysed#1663299 | Valid | SQL Injection | High | 2022-08-09 | – | 29 |
| [Bypass] Ability to invite a new member in sandbox OrganizationAnalysed#1486417 | Valid | Input Validation and Logic | Medium | 2022-04-14 | – | 35 |
| Any organization's assets pending review can be downloadedAnalysed#1787644 | Valid | Information Disclosure | High | 2022-11-29 | – | 76 |
| HTML Injection in email via Name fieldAnalysed#1581499 | Valid | Cross-site Scripting | Low | 2022-09-18 | $500 | 84 |
| Blind XSS in app.pullrequest.com/████████ via /reviews/ratings/{uuid}Analysed#1558010 | Valid | Cross-site Scripting | High | 2022-05-25 | – | 102 |
| An attacker can archive and unarchive any structured scope object on HackerOneAnalysed#1501611 | Valid | No weakness recorded | High | 2022-04-18 | – | 318 |
| June 2022 Incident ReportAnalysed#1622449 | Valid | No weakness recorded | Critical | 2022-07-01 | – | 426 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,686 analysed so far), which can be wrong. Data as of 2026-11-15.