Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Subdomain Takeover via unclaimed UserVoice domainAnalysed#269109 | Valid | Access Control | High | 2017-10-04 | $250 | 18 |
| Domain Takeover in [obviousengine.com] a snapchat acquisitionsAnalysed#392785 | Valid | Access Control | High | 2018-10-07 | – | 32 |
| Client IP Spoofing using "X-Forwarded-For: 127.0.0.1" on "studio-app.snapchat.com" exposing bucket detailsAnalysed#382678 | Valid | Access Control | High | 2021-08-12 | $500 | 40 |
| Leaked JFrog Artifactory username and password exposed on GitHub - https://snapchat.jfrog.ioAnalysed#911606 | Valid | Information Disclosure | High | 2021-08-12 | $15,000 | 137 |
| Stealing SSO Login Tokens (snappublisher.snapchat.com)Analysed#265943 | Valid | Authentication | High | 2021-07-29 | $7,500 | 244 |
| Open prod Jenkins instanceAnalysed#231460 | Valid | Information Disclosure | High | 2017-08-19 | $15,000 | 436 |
| Access to multiple production Grafana dashboardsAnalysed#663628 | Valid | Information Disclosure | High | 2020-11-04 | $10,000 | 464 |
| Delete anyone's content spotlight remotely.Analysed#1819832 | Valid | Insecure Direct Object Reference | High | 2023-03-06 | $15,000 | 801 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.