Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| nginx SPDY heap buffer overflow for https://grtp.co/#116352 | Informative | Gratipay | Memory Corruption | None | 2016-02-15 | – | – |
| proxy port 7000 and shell port 514 not filtered#116618 | Informative | Gratipay | Misconfiguration and Insecure Design | None | 2016-02-20 | – | – |
| server calendar and server status available to public#116621 | Informative | Gratipay | Information Disclosure | None | 2016-02-20 | – | – |
| UDP port 5060 (SIP) Open#116774 | Informative | Gratipay | Denial of Service | None | 2016-02-16 | – | – |
| Error Page Text Injection#176042 | Informative | Yelp | Misconfiguration and Insecure Design | None | 2017-11-09 | – | – |
| [Yelp Blog] Backslash in search string causes JS error#179732 | Informative | Yelp | Misconfiguration and Insecure Design | None | 2017-11-09 | – | – |
| Device confirmation Flaw#254869 | Informative | Coinbase | No weakness recorded | None | 2017-08-02 | – | – |
| Special characters are not filtered out on profile fields#260838 | Informative | Legal Robot | No weakness recorded | None | 2017-08-26 | – | – |
| Clickjacking https://blockstack.org/#269047 | Informative | Hiro | No weakness recorded | None | 2017-10-05 | – | – |
| Cross site request forgery#269196 | Informative | Hiro | Cross-Site Request Forgery | None | 2018-01-10 | – | – |
| Limited arbitrary text inclusion in user invite emails#278220 | Informative | Inflection | Input Validation and Logic | None | 2017-11-29 | – | – |
| Broken link for stale DNS entry may be leveraged for Phishing, Misinformation, Serving Malware#279351 | Informative | Gratipay | No weakness recorded | None | 2017-10-18 | – | – |
| Integer Underflow @ ossl_cipher_pkcs5_keyivgen#304115 | Informative | Ruby | Memory Corruption | None | 2018-02-23 | – | – |
| Invalid URL parsing '#'#341634 | Informative | Ruby | No weakness recorded | None | 2018-05-01 | – | – |
| Information Disclosure PHPpgAdmin#463177 | Valid | RATELIMITED | Information Disclosure | None | 2020-02-29 | – | – |
| Clickjacking on https://nextcloud.com/#661768 | Duplicate | Nextcloud | Misconfiguration and Insecure Design | None | 2019-11-11 | – | – |
| Internal IP addresses range and AWS cluster region leaked in a Github repository#877303 | Informative | Kubernetes | Information Disclosure | None | 2020-07-24 | – | – |
| Hard coded Username and password in GiHub commit#877402 | Informative | Kubernetes | Authentication | None | 2020-07-24 | – | – |
| Information Disclosure at one of your subdomain#1195423 | N/A | Sifchain | Information Disclosure | None | 2021-12-09 | – | – |
| CVE-2026-92386: server-set cookie aborts cookie jar load#4021979 | Valid | curl | No weakness recorded | None | 2026-10-14 | – | – |
| CVE-2026-92387: never-ending loop via server response omission#4022003 | Valid | curl | No weakness recorded | None | 2026-10-14 | – | – |
| CVE-2026-92388: FTP wildcard write callback mixup#4022070 | Valid | curl | No weakness recorded | None | 2026-10-14 | – | – |
| CVE-2026-92389: TFTP direction confusion#4022568 | Valid | curl | No weakness recorded | None | 2026-10-14 | – | – |
| CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints#4023192 | Valid | curl | No weakness recorded | None | 2026-10-14 | – | – |
| grtp.co is vulnerable to http-vuln-cve2011-3192#112687 | Informative | Gratipay | Denial of Service | None | 2016-02-12 | – | 1 |
| An adversary can harvest email address for spamming.#128035 | Informative | Gratipay | Misconfiguration and Insecure Design | None | 2016-04-05 | – | 1 |
| Getting Error Message and in use python version 2.7 is exposed.#128041 | Informative | Gratipay | Information Disclosure | None | 2016-04-05 | – | 1 |
| text injection in website title#128764 | Informative | Gratipay | Misconfiguration and Insecure Design | None | 2016-04-30 | – | 1 |
| don't expose path of Python#138659 | Informative | Gratipay | Information Disclosure | None | 2016-05-13 | – | 1 |
| Username .. (double dot) should be restricted or handled carefully#152477 | Informative | Gratipay | Misconfiguration and Insecure Design | None | 2016-07-20 | – | 1 |
| Cookie:HttpOnly Flag not set#157563 | Duplicate | Gratipay | Misconfiguration and Insecure Design | None | 2016-08-08 | – | 1 |
| XSS found In Your Web#164922 | Informative | Gratipay | Cross-site Scripting | None | 2017-10-01 | – | 1 |
| ClickJacking#179839 | Duplicate | Yelp | Misconfiguration and Insecure Design | None | 2017-11-09 | – | 1 |
| CSRF Token Design Flaw#216161 | Informative | Udemy | Cross-Site Request Forgery | None | 2017-08-28 | – | 1 |
| POODLE SSLv3.0#219499 | Informative | Gratipay | No weakness recorded | None | 2017-04-09 | – | 1 |
| DNSSEC Zone Walk using NSEC Records#228471 | Informative | Weblate | Information Disclosure | None | 2018-01-30 | – | 1 |
| CSP "script-src" includes "unsafe-inline" in weblate.org and demo.weblate.org#231062 | Informative | Weblate | Misconfiguration and Insecure Design | None | 2017-05-23 | – | 1 |
| X-Frame-Options#237071 | Informative | Coinbase | Misconfiguration and Insecure Design | None | 2017-06-22 | – | 1 |
| CSP Policy Bypass and javascript execution Still Not Fixed#241341 | Duplicate | Gratipay | No weakness recorded | None | 2017-06-19 | – | 1 |
| Weak Password#256663 | Informative | Udemy | Misconfiguration and Insecure Design | None | 2017-08-28 | – | 1 |
| Violation of secure design principle#256665 | Informative | Udemy | Misconfiguration and Insecure Design | None | 2017-08-17 | – | 1 |
| Sub domain take over in gratipay.com#257331 | Informative | Gratipay | Misconfiguration and Insecure Design | None | 2017-08-08 | – | 1 |
| No rate limit or captcha to identify humans#257384 | Valid | Weblate | Misconfiguration and Insecure Design | None | 2017-09-15 | – | 1 |
| Tampering the mail id on chatbox#260239 | Informative | Legal Robot | No weakness recorded | None | 2017-08-16 | – | 1 |
| Profile fields validation mismatch#260316 | Valid | Legal Robot | No weakness recorded | None | 2017-09-15 | – | 1 |
| Information Discloser#260645 | Informative | Legal Robot | Information Disclosure | None | 2017-10-11 | – | 1 |
| Weak Cryptography for Passwords#260689 | Informative | Legal Robot | Authentication | None | 2017-08-21 | – | 1 |
| Name can't be numbers or email#263196 | Informative | Legal Robot | Authentication | None | 2017-08-25 | – | 1 |
| 400 Bad Request [Use a third-party provider to sign in or create an account on Gratipay]#267212 | N/A | Gratipay | Misconfiguration and Insecure Design | None | 2017-09-09 | – | 1 |
| Weak crossdomain.xml#269184 | Informative | Hiro | No weakness recorded | None | 2018-01-18 | – | 1 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.