Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Possibility to freeze/crash the host system of all Slack Desktop users easily#392728 | Valid | Misconfiguration and Insecure Design | Low | 2020-11-10 | – | 9 |
| dom xss in https://www.slackatwork.comAnalysed#196624 | Valid | Cross-site Scripting | Low | 2017-03-02 | – | 13 |
| HTML Injection inside Slack promotional emailsAnalysed#321029 | Valid | No weakness recorded | Low | 2018-07-30 | $100 | 13 |
| Cross-site leak allows attacker to de-anonymize members of his team from another originAnalysed#1068153 | Valid | Access Control | Low | 2021-11-11 | $250 | 13 |
| Invitation reminder emails contain insecure linksAnalysed#327674 | Valid | Cryptography | Low | 2019-06-29 | $350 | 15 |
| Uninstalling Slack for Windows (64-bit), then reinstalling keeps you logged in without authenticationAnalysed#238260 | Valid | Authentication | Low | 2020-11-10 | $500 | 18 |
| Subdomain takeover on podcasts.slack-core.comAnalysed#195350 | Valid | Cross-site Scripting | Low | 2017-01-04 | $100 | 27 |
| Email html InjectionAnalysed#1461194 | Valid | Command and Code Injection | Low | 2022-05-19 | $250 | 28 |
| URL filter bypass in Enterprise GridAnalysed#500348 | Valid | Input Validation and Logic | Low | 2020-02-14 | $100 | 32 |
| Slack-Corp Heroku application disclosing limited info about company membersAnalysed#966814 | Valid | Information Disclosure | Low | 2020-12-09 | – | 39 |
| Information leakage and default open portAnalysed#305518 | Valid | No weakness recorded | Low | 2019-06-22 | – | 41 |
| Linux Desktop application slack executable does not use pie / no ASLRAnalysed#415272 | Valid | Misconfiguration and Insecure Design | Low | 2019-11-17 | $100 | 47 |
| URL link spoofingAnalysed#481472 | Valid | Input Validation and Logic | Low | 2020-04-26 | $250 | 362 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.