Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Security misconfiguration "weak passwords".#285482 | Informative | Misconfiguration and Insecure Design | Medium | 2018-03-13 | – | 1 |
| clickjacking to Semrush auth login#318295 | Informative | Misconfiguration and Insecure Design | None | 2018-03-13 | – | 2 |
| Insecure Direct Object Reference on API without API key#284963 | Informative | No weakness recorded | High | 2018-03-13 | – | 4 |
| Cross-origin resource sharing#288912 | Informative | No weakness recorded | High | 2018-01-11 | – | 4 |
| Broken Authentication: A project addition request can be used multiple time for different users#319480 | Informative | Cryptography | High | 2018-03-13 | – | 5 |
| CORS (Cross-Origin Resource Sharing)#310579 | Informative | Authentication | Low | 2018-03-20 | – | 6 |
| Web cache deception attack - expose earning state information#439021 | Informative | Access Control | Low | 2019-04-12 | – | 10 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.