Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Reflected DOM-Based XSS On Due Lack Filter On Parameter ?next#545121 | No longer public | Cross-site Scripting | – | – | – | 3 |
| Unauthorized admission to any team in zeit.co#681882 | No longer public | Authentication | – | – | – | 3 |
| [serve] Path Traversal#510043 | No longer public | File and Path Handling | – | – | – | 5 |
| Stored XSS in profile page#541853 | No longer public | Cross-site Scripting | – | – | – | 7 |
| Open redirection in https://zeit.co/login?next=#618214 | No longer public | Open Redirect | – | – | – | 7 |
| Access control bypass leads to domain information disclosure#630192 | No longer public | Authentication | – | – | – | 8 |
| [Fix Bypass #541631] Open redirect on Signup#541948 | No longer public | Open Redirect | – | – | – | 9 |
| User personal data disclosure via API#630235 | No longer public | Information Disclosure | – | – | – | 12 |
| Stored Cross-site scripting#541710 | No longer public | Cross-site Scripting | – | – | – | 13 |
| Stored XSS on Zeit.co user profile#541737 | No longer public | Cross-site Scripting | – | – | – | 21 |
| CSRF On Connect Account With Github Lead To Account Takeover#542047 | No longer public | Cross-Site Request Forgery | – | – | – | 29 |
| Open Redirect on Gitllab Oauth leading to Acount Takeover#677617 | No longer public | Open Redirect | – | – | – | 34 |
| Gitlab Oauth Misconfiguration Lead To Account Takeover#541701 | No longer public | No weakness recorded | – | – | – | 39 |
| through %09 Character the attacker is able to steal Github Token [ Account Takeover ]#763058 | No longer public | Open Redirect | – | – | – | 44 |
| Open redirect vuln on login#608031 | No longer public | Open Redirect | – | – | – | 45 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,686 analysed so far), which can be wrong. Data as of 2026-11-15.