Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| an xss issue in https://hunter22.slack.com/help/requests/793043#116419 | Valid | Cross-site Scripting | – | 2016-04-30 | $100 | 1 |
| Unauthenticated Access to some old file thumbnails#145621 | Informative | Authentication | – | 2016-06-21 | – | 2 |
| Executing scripts on slack-files.com using SVG#100565 | Valid | Cross-site Scripting | – | 2016-02-18 | – | 4 |
| Trick make all fixed open redirect links vulnerable again#104087 | Valid | Open Redirect | – | 2016-05-22 | $1,000 | 4 |
| File upload over private IM channel#143903 | Valid | Access Control | – | 2016-07-13 | – | 5 |
| Generate new Test token#147544 | Valid | Authentication | – | 2016-09-15 | $100 | 5 |
| Email information leakage for certain addresses#169992 | Valid | Information Disclosure | – | 2016-10-31 | $400 | 5 |
| a stored xss in slack integration https://onerror.slack.com/services/import#33018 | Valid | Cross-site Scripting | – | 2016-05-22 | $500 | 6 |
| RC4 cipher suites detected on status.slack.com#99157 | Valid | Misconfiguration and Insecure Design | – | 2016-11-18 | – | 6 |
| CSRF - Add optional two factor mobile number#155774 | Valid | Cross-Site Request Forgery | – | 2016-08-17 | $500 | 7 |
| Authentication bypass leads to sensitive data exposure (token+secret)#129918 | Valid | Authentication | – | 2016-10-19 | $2,000 | 10 |
| User can start call in a channel of an unpaid account#147369 | Valid | Access Control | – | 2016-09-15 | $100 | 10 |
| Creating Post on a restricted channel#151459 | Valid | Access Control | – | 2016-09-29 | – | 10 |
| Open Redirect on slack.com#140447 | Valid | Cross-site Scripting | – | 2016-10-02 | $500 | 12 |
| Bypass of the SSRF protection (Slack commands, Phabricator integration)#61312 | Valid | No weakness recorded | – | 2016-09-14 | $100 | 14 |
| Information Disclosure on stun.screenhero.com#175061 | Valid | Information Disclosure | Medium | 2016-11-30 | $700 | 14 |
| CSRF in github integration#174328 | Valid | Cross-Site Request Forgery | Medium | 2016-11-18 | $500 | 22 |
| Source code leakage through GIT web access at host '52.91.137.42'Analysed#148068 | Valid | Authentication | – | 2016-08-15 | – | 26 |
| Rate-limit bypassAnalysed#165727 | Valid | Authentication | – | 2016-11-28 | $500 | 27 |
| Stored XSS(Cross Site Scripting) In Slack App NameAnalysed#159460 | Valid | Cross-site Scripting | – | 2016-11-22 | $1,000 | 29 |
| Snooping into messages via email serviceAnalysed#163938 | Valid | Authentication | – | 2016-09-14 | – | 30 |
| OSX slack:// protocol handler javascript injectionAnalysed#79348 | Valid | Command and Code Injection | – | 2016-06-24 | – | 72 |
| Stored XSS on team.slack.com using new Markdown editor of posts inside the Editing mode and using javascript-URIsAnalysed#132104 | Valid | Cross-site Scripting | – | 2016-09-01 | – | 103 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,686 analysed so far), which can be wrong. Data as of 2026-11-15.