Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Captcha bypass with extension at http://www.mopub.com/about/contact/#15047 | Informative | Cryptography | – | 2014-09-22 | – | 1 |
| Options Method Enabled#33987 | Informative | No weakness recorded | – | 2014-12-26 | – | 1 |
| No rate limiting on creating lists#42250 | Informative | Misconfiguration and Insecure Design | – | 2015-01-06 | – | 1 |
| Path disclosure in platform0.twitter.com#44371 | Informative | Information Disclosure | – | 2015-02-20 | – | 1 |
| Creating Unauthorized Audience Lists#31188 | Informative | Misconfiguration and Insecure Design | – | 2014-11-28 | – | 2 |
| BROKEN AUTHENTICATION IN MOBILE VERIFICATION#33432 | Informative | Misconfiguration and Insecure Design | – | 2014-12-14 | – | 2 |
| Option Method Enabled on web server#33986 | Informative | No weakness recorded | – | 2014-12-25 | – | 2 |
| Homograph attack.#37108 | Informative | Misconfiguration and Insecure Design | – | 2015-01-01 | – | 2 |
| Privacy Issue on protected tweets#55506 | Informative | Authentication | – | 2015-05-14 | – | 2 |
| OS Command Execution on User's PC via CSV Injection#282628 | Informative | Command and Code Injection | Medium | 2017-11-02 | – | 2 |
| Opportunity to post hidden comments#434202 | Informative | Input Validation and Logic | Critical | 2018-12-11 | – | 2 |
| Token remains alive ever after logging out!#14177 | Informative | Authentication | – | 2014-11-17 | – | 3 |
| uclfinal.twitter.com and euro2012.twitter.com are vulnerable to CRIME attack#14199 | Informative | Cryptography | – | 2014-08-16 | – | 3 |
| Flaw in valid password policy.#33331 | Informative | Authentication | – | 2014-11-30 | – | 3 |
| Headers Missing#36053 | Informative | Misconfiguration and Insecure Design | – | 2014-11-15 | – | 3 |
| Abuse of "Remember Me" functionality.#37822 | Informative | Authentication | – | 2014-12-29 | – | 3 |
| Privecy Issue : view "Protected users" followers and following#56119 | Informative | Authentication | – | 2015-05-15 | – | 3 |
| Password reset link not validated.#22012 | Informative | Denial of Service | – | 2014-08-31 | – | 4 |
| Notifications can mark as read by CSRF#36980 | Informative | Cross-Site Request Forgery | – | 2015-01-03 | – | 4 |
| Account Deleted without any confirmation#42403 | Informative | Authentication | – | 2015-02-05 | – | 4 |
| Cross site Port Scanning bug in twitter developers console#49474 | Informative | Cryptography | – | 2015-05-23 | – | 4 |
| List of a ton of internal twitter servers available on GitHub#137404 | Informative | Information Disclosure | – | 2016-10-17 | – | 4 |
| Broken authentication and invalidated email address leads to account takeover#22203 | Informative | Cryptography | – | 2014-11-28 | – | 9 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.