Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Invitation reminder emails contain insecure linksAnalysed#327674 | Valid | Cryptography | Low | 2019-06-29 | $350 | 15 |
| CSS Injection to disable app & potential message exfilAnalysed#679969 | Valid | Input Validation and Logic | Medium | 2019-11-09 | – | 37 |
| Information leakage and default open portAnalysed#305518 | Valid | No weakness recorded | Low | 2019-06-22 | – | 41 |
| Linux Desktop application slack executable does not use pie / no ASLRAnalysed#415272 | Valid | Misconfiguration and Insecure Design | Low | 2019-11-17 | $100 | 47 |
| Bypass of the SSRF protection in Event Subscriptions parameter.Analysed#386292 | Valid | Server-Side Request Forgery | Medium | 2019-02-22 | – | 52 |
| SSRF in api.slack.com, using slash commands and bypassing the protections.Analysed#381129 | Valid | Server-Side Request Forgery | Medium | 2019-02-22 | – | 84 |
| User-assisted RCE in Slack for macOS (from official site) due to improper quarantine meta-attribute handling for downloaded filesAnalysed#470637 | Valid | No weakness recorded | High | 2019-09-14 | – | 97 |
| Real Time Error Logs Through Debug InformationAnalysed#503283 | Valid | Information Disclosure | High | 2019-04-11 | – | 100 |
| XSS in gist integrationAnalysed#11073 | Valid | Cross-site Scripting | – | 2019-04-28 | $500 | 157 |
| AWS bucket leading to iOS test build code and configuration exposureAnalysed#404822 | Valid | Information Disclosure | Critical | 2019-02-23 | $1,500 | 321 |
| XSS vulnerable parameter in a location hashAnalysed#146336 | Valid | Cross-site Scripting | – | 2019-10-16 | – | 455 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.