Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Can see private tweets via keyword searches on tweetdeck#97161 | Valid | Access Control | – | 2016-02-16 | – | 3 |
| Full Path Disclosure at 27.prd.vine.co#175451 | Valid | No weakness recorded | Low | 2016-10-21 | $140 | 3 |
| Subdomain Expired#101104 | Valid | Authentication | – | 2016-01-15 | – | 4 |
| Sub-Domain Takeover#119220 | Valid | No weakness recorded | – | 2016-03-18 | – | 4 |
| xss in DM group name in twitter#129436 | Valid | Cross-site Scripting | – | 2016-04-22 | – | 4 |
| List of a ton of internal twitter servers available on GitHub#137404 | Informative | Information Disclosure | – | 2016-10-17 | – | 4 |
| XSS via Fabrico Account Name#34725 | Valid | Cross-site Scripting | – | 2016-07-11 | – | 5 |
| Tweetdeck (twitter owned app) not revoked#90172 | Valid | Authentication | – | 2016-04-29 | – | 5 |
| Tweet Deck XSS- Persistent- Group DM name#119022 | Valid | Cross-site Scripting | – | 2016-03-04 | – | 5 |
| XSS in the "Poll" Feature on Twitter.com#95231 | Valid | Cross-site Scripting | – | 2016-08-12 | – | 6 |
| Urgent : Disclosure of all the apps with hash ID in mopub through API request (Authentication bypass)#98432 | Valid | Authentication | – | 2016-08-22 | – | 6 |
| Profile Pic padding (Length-hiding) fails due to use of GZIP#29835 | Valid | Information Disclosure | – | 2016-03-18 | $280 | 7 |
| Add tweet to collection CSRF#100820 | Valid | Cross-Site Request Forgery | – | 2016-08-22 | – | 12 |
| xss in link items (mopub.com)#100931 | Valid | Cross-site Scripting | – | 2016-07-05 | $560 | 14 |
| XSS using javascript:alert(8007)#127154 | Valid | Cross-site Scripting | Low | 2016-11-28 | – | 15 |
| IDOR- Activate Mopub on different organizations- steal api token- Fabric.io#95552 | Valid | Authentication | – | 2016-01-25 | – | 18 |
| File Upload XSS in image uploading of App in mopubAnalysed#97672 | Valid | Cross-site Scripting | – | 2016-08-25 | – | 24 |
| Information Disclosure through .DS_Store in ██████████Analysed#142549 | Valid | Information Disclosure | – | 2016-12-12 | $560 | 27 |
| [Critical] - Steal OAuth TokensAnalysed#131202 | Valid | Authentication | – | 2016-07-11 | – | 31 |
| Twitter iOS fails to validate server certificate and sends oauth tokenAnalysed#168538 | Valid | Cryptography | High | 2016-12-23 | $2,100 | 40 |
| Cross-site scripting (reflected)Analysed#176754 | Valid | Cross-site Scripting | Medium | 2016-12-09 | – | 45 |
| View liked twits of private account via publish.twitter.comAnalysed#174721 | Valid | Information Disclosure | Medium | 2016-11-14 | – | 47 |
| Bypassing callback_url validation on DigitsAnalysed#108113 | Valid | Open Redirect | – | 2016-08-12 | – | 48 |
| reverb.twitter.com redirects to vulnerable reverb.guruAnalysed#158148 | Valid | No weakness recorded | – | 2016-10-01 | – | 50 |
| Html Injection and Possible XSS in sms-be-vip.twitter.comAnalysed#150179 | Valid | Cross-site Scripting | – | 2016-08-28 | – | 83 |
| Bypassing Digits web authentication's host validation with HPPAnalysed#114169 | Valid | Authentication | – | 2016-08-12 | – | 108 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.