Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Reflected Cross Site Scripting (XSS)#435144	Informative	Cross-site Scripting	Medium	2019-04-30	–	11
Unrestricted access to any "connected pack" on docs#777942	Valid	Access Control	Medium	2020-04-14	–	27
Permissive CORS policy trusting arbitrary extensions originAnalysed#412490	Valid	Access Control	Medium	2019-11-06	$500	33
`open-url` command allows opening unlimited number of tabs pointing to arbitrary URLsAnalysed#389076	Valid	No weakness recorded	Medium	2019-04-23	–	37
Grammarly Keyboard for Android "Authorization Code with PKCE" flow implementation vulnerability that allows account takeoverAnalysed#824931	Valid	Cryptography	Medium	2020-07-24	–	76
“email” MFA mode allows bypassing MFA from victim’s device when the device trust is not expiredAnalysed#665722	Valid	Authentication	Medium	2019-08-12	$2,500	82
Use Github pack with Coda employee github account (search code of Coda's private repositories)Analysed#676581	Valid	No weakness recorded	Medium	2020-01-02	–	104
Lack of CSRF header validation at https://g-mail.grammarly.com/profileAnalysed#629892	Valid	Information Disclosure	Medium	2019-10-31	–	140
Previously created sessions continue being valid after MFA activationAnalysed#667739	Valid	Access Control	Medium	2019-08-19	–	176
Config override using non-validated query parameter allows at least reflected XSS by injecting configuration into stateAnalysed#1082847	Valid	Input Validation and Logic	Medium	2021-03-01	–	223

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,437 analysed so far), which can be wrong. Data as of 2026-11-15.