Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| RTLO char allowed in chat#196222 | Valid | Misconfiguration and Insecure Design | Medium | 2017-02-28 | – | 18 |
| Subdomain Takeover via unclaimed UserVoice domain#269109 | Valid | Access Control | High | 2017-10-04 | $250 | 18 |
| [render.bitstrips.com] Stored XSS via an incorrect avatar property valueAnalysed#159878 | Valid | Cross-site Scripting | – | 2017-01-04 | $400 | 21 |
| [spectacles.com] Bypassing quantity limit in ordersAnalysed#246803 | Valid | Injection and Smuggling | Medium | 2017-08-12 | $250 | 22 |
| CRLF Injection at vpn.bitstrips.comAnalysed#237357 | Valid | Injection and Smuggling | Medium | 2017-06-15 | – | 24 |
| Subdomain Takeover via Unclaimed WordPress siteAnalysed#274336 | Valid | Authentication | Medium | 2017-10-06 | – | 39 |
| RCE/LFI on test Jenkins instance due to improper authentication flowAnalysed#258117 | Valid | Access Control | Medium | 2017-08-19 | – | 118 |
| Open prod Jenkins instanceAnalysed#231460 | Valid | Information Disclosure | High | 2017-08-19 | $15,000 | 436 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.