Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Information disclosue in Android Application#201855 | Duplicate | Coinbase | Denial of Service | Low | 2017-08-30 | – | – |
| SSl Weak Ciphers#244070 | Duplicate | Gratipay | Cryptography | Low | 2017-07-10 | – | – |
| Logout CSRF#244778 | Duplicate | WakaTime | Cross-Site Request Forgery | Low | 2017-08-29 | – | – |
| Error Page Content Spoofing or Text Injection#263866 | Duplicate | GSA Bounty | No weakness recorded | – | 2017-11-17 | – | – |
| Ports are not shown in third-party site redirect warning page.#482170 | Duplicate | Semrush | No weakness recorded | Low | 2019-04-12 | – | – |
| Clickjacking on https://nextcloud.com/#661768 | Duplicate | Nextcloud | Misconfiguration and Insecure Design | None | 2019-11-11 | – | – |
| Failure to Invalid Session after Password Change#957557 | Duplicate | Rockset | No weakness recorded | – | 2021-11-09 | – | – |
| Design Issues at Main Domain#1188652 | Duplicate | Sifchain | Misconfiguration and Insecure Design | Low | 2021-12-09 | – | – |
| Wrong Url in Main page of sifchain.finance#1195512 | Duplicate | Sifchain | Misconfiguration and Insecure Design | Low | 2021-12-09 | – | – |
| 14: HSTS cache import silently drops a longer-lived child beneath an includeSubDomains parent#3973124 | Duplicate | curl | Cryptography | – | 2026-10-26 | – | – |
| Email spoofing#115232 | Duplicate | Paragon Initiative Enterprises | Misconfiguration and Insecure Design | – | 2016-06-17 | – | 1 |
| Missing SPF records for paragonie.com#115250 | Duplicate | Paragon Initiative Enterprises | Misconfiguration and Insecure Design | – | 2016-06-17 | – | 1 |
| Missing SPF for paragonie.com#115315 | Duplicate | Paragon Initiative Enterprises | Misconfiguration and Insecure Design | – | 2016-04-27 | – | 1 |
| Missing SPF for paragonie.com#115390 | Duplicate | Paragon Initiative Enterprises | Misconfiguration and Insecure Design | – | 2016-06-17 | – | 1 |
| Reflected Cross Site Script in imtportal.gm.com#120622 | Duplicate | General Motors | Cross-site Scripting | – | 2017-06-09 | – | 1 |
| XSS on love.uber.com#125179 | Duplicate | Uber | Cross-site Scripting | – | 2016-05-09 | – | 1 |
| SMS Flood with Update Profile#126536 | Duplicate | Uber | Denial of Service | – | 2016-06-13 | – | 1 |
| CrashPlan Backup is Vulnerable Allowing to a DoS Attack Against Uber's Backups to ```backup.uber.com```#131560 | Duplicate | Uber | No weakness recorded | – | 2016-05-09 | – | 1 |
| Missing SPF for hackerone.com#131722 | Duplicate | bitaccess | Misconfiguration and Insecure Design | – | 2016-05-27 | – | 1 |
| XSS in Blog#141728 | Duplicate | drchrono | Cross-site Scripting | – | 2016-06-13 | – | 1 |
| Self-XSS in Partners Profile#145289 | Duplicate | Uber | Cross-site Scripting | – | 2016-07-07 | – | 1 |
| Cookie:HttpOnly Flag not set#157563 | Duplicate | Gratipay | Misconfiguration and Insecure Design | None | 2016-08-08 | – | 1 |
| Denial of service(POP UP Recursion) on Brave browser#179248 | Duplicate | Brave Software | Denial of Service | Medium | 2016-11-07 | – | 1 |
| ClickJacking#179839 | Duplicate | Yelp | Misconfiguration and Insecure Design | None | 2017-11-09 | – | 1 |
| Remote Stack Overflow Vulnerability (DoS)#181061 | Duplicate | Brave Software | Denial of Service | – | 2017-08-10 | – | 1 |
| ClickJacking#183127 | Duplicate | OWOX, Inc. | Misconfiguration and Insecure Design | – | 2017-05-22 | – | 1 |
| Cross-Site Request Forgery#215383 | No longer public | Mail.ru | Cross-Site Request Forgery | – | 2019-06-02 | – | 1 |
| homograph-attack (unicode vuln)#221461 | Duplicate | Brave Software | No weakness recorded | – | 2017-08-10 | – | 1 |
| Sensitive information disclosure via response headers on jenkins.brew.sh#222063 | Duplicate | Homebrew | Information Disclosure | Low | 2017-04-25 | – | 1 |
| Email Spoofing#240987 | Duplicate | Gratipay | Misconfiguration and Insecure Design | – | 2017-06-17 | – | 1 |
| CSP Policy Bypass and javascript execution Still Not Fixed#241341 | Duplicate | Gratipay | No weakness recorded | None | 2017-06-19 | – | 1 |
| Possible user session hijack by invalid HTTPS certificate on inside.gratipay.com domain#241892 | Duplicate | Gratipay | Misconfiguration and Insecure Design | Low | 2017-06-21 | – | 1 |
| Arbitrary local code execution via DLL hijacking from executable installer#272221 | Duplicate | Brave Software | Misconfiguration and Insecure Design | Medium | 2018-07-09 | – | 1 |
| Email Spoofing#276614 | Duplicate | Semrush | Misconfiguration and Insecure Design | Medium | 2018-03-13 | – | 1 |
| No notification on Password Change#282570 | Duplicate | Infogram | No weakness recorded | Medium | 2017-10-27 | – | 1 |
| Host Header Injection allow HiJack Password Reset Link#301592 | Duplicate | Concrete CMS | No weakness recorded | Low | 2018-01-12 | – | 1 |
| The csrf token remains same after user logs in#361400 | Duplicate | Liberapay | Misconfiguration and Insecure Design | – | 2018-06-04 | – | 1 |
| Csrf token does not meet security design#362033 | Duplicate | Liberapay | No weakness recorded | – | 2018-06-05 | – | 1 |
| Information Exposure Through Directory Listing - https://apps.nextcloud.com/static/#403909 | Duplicate | Nextcloud | Information Disclosure | Low | 2019-01-07 | – | 1 |
| Clickjacking on https://download.nextcloud.com#658011 | Duplicate | Nextcloud | Misconfiguration and Insecure Design | – | 2019-11-11 | – | 1 |
| Clickjacking on https://download.nextcloud.com/#662155 | Duplicate | Nextcloud | Misconfiguration and Insecure Design | None | 2019-11-11 | – | 1 |
| Nextcloud Clickjacking Vulnerability#710996 | Duplicate | Nextcloud | Misconfiguration and Insecure Design | Low | 2019-11-11 | – | 1 |
| Sensitive Information disclosure Through Config File#775123 | Duplicate | Kubernetes | Information Disclosure | – | 2020-07-24 | – | 1 |
| There is any issue No valid SPF Records#864696 | Duplicate | Kubernetes | Authentication | None | 2020-07-24 | – | 1 |
| csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC#995699 | Duplicate | Kubernetes | Memory Corruption | Medium | 2021-01-07 | – | 1 |
| Email Spoofing bug#1176090 | Duplicate | Sifchain | No weakness recorded | – | 2021-12-09 | – | 1 |
| Vulnerability : Email Spoofing#1180668 | Duplicate | Sifchain | No weakness recorded | None | 2021-12-09 | – | 1 |
| Username disclosure at Main Domain#1188662 | Duplicate | Sifchain | Information Disclosure | Low | 2021-12-09 | – | 1 |
| Information disclosure on Sifchain#1188998 | Duplicate | Sifchain | Information Disclosure | None | 2021-05-08 | – | 1 |
| 20: HTAB before `Secure` attribute silently drops the Secure cookie flag#3971551 | Duplicate | curl | No weakness recorded | – | 2026-10-26 | – | 1 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.