Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Bypass to postMessage origin validation via FTP#210654	Valid	Cross-site Scripting	High	2017-04-21	–	15
Misuse of groups feature allows workspace members to join private channels without being invitedAnalysed#1248852	Valid	Access Control	High	2021-10-21	–	23
Workspace configuration metadata disclosureAnalysed#864489	Valid	Information Disclosure	High	2022-04-01	–	39
Store XSSAnalysed#187410	Valid	Cross-site Scripting	High	2017-01-01	–	44
[Android] Directory traversal leading to disclosure of auth tokensAnalysed#1378889	Valid	File and Path Handling	High	2022-02-25	$3,500	50
The Custom Emoji Page has a Reflected XSSAnalysed#258198	Valid	Cross-site Scripting	High	2017-09-24	–	56
Eavesdropping on private Slack callsAnalysed#184698	Valid	Authentication	High	2017-02-08	$1,000	68
Stored XSS through PDF viewerAnalysed#881557	Valid	Cross-site Scripting	High	2022-03-16	$4,875	76
User-assisted RCE in Slack for macOS (from official site) due to improper quarantine meta-attribute handling for downloaded filesAnalysed#470637	Valid	No weakness recorded	High	2019-09-14	–	97
Real Time Error Logs Through Debug InformationAnalysed#503283	Valid	Information Disclosure	High	2019-04-11	–	100
Tricking the "Create snippet" feature into displaying the wrong filetype can lead to RCE on Slack usersAnalysed#833080	Valid	File and Path Handling	High	2020-06-30	$1,500	101
Team members can trigger arbitrary code execution in Slack Desktop Apps via HTML NotificationsAnalysed#816156	Valid	Command and Code Injection	High	2021-05-09	–	107
Unauthenticated LFI revealing log informationAnalysed#272578	Valid	Information Disclosure	High	2018-01-26	–	123
Slack DTLS uses a private key that is in the public domain, which may lead to SRTP stream hijackAnalysed#531032	Valid	Cryptography	High	2020-03-12	$2,000	170

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.