Intel · bug bounty

Disclosed bug bounty reports

Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.

SortMost upvoted

StatusAny

SeverityAny

DisclosedAny year

WeaknessAny class

Access (title)Any

Access (analysis)No account

TechniqueAny

Clear

65 of 15,219 reports · $401,945 in bounties · 161 analysed so far

#510152ValidAnalysedBypass for #488147 enables stored XSS on https://paypal.com/signin againPayPal · Injection and Smuggling · 2019 · needs: no account · Request smuggling, Cache poisoning$20,0002,687votes
#745324ValidAnalysedAccount takeover via leaked session cookieHackerOne · Authentication · 2019 · needs: no account · Account takeover chain, Session fixation or reuse, Information disclosure$20,0001,642votes
#1087489ValidAnalysedGithub access token exposureShopify · No weakness recorded · 2021 · needs: no account · Leaked secret or key, Information disclosure$50,0001,601votes
#739737ValidAnalysedToken leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordPayPal · Authentication · 2020 · needs: no account · Information disclosure, Authentication bypass$15,3001,409votes
#470520ValidAnalysedRCE on Steam Client via buffer overflow in Server InfoValve · Memory Corruption · 2019 · needs: no account · Memory corruption, Code injection / eval–1,289votes
#591295ValidAnalysedPotential pre-auth RCE on Twitter VPNX / xAI · Command and Code Injection · 2019 · needs: no account · Path traversal, Information disclosure, 2FA bypass, Session fixation or reuse$20,1601,246votes
#455645ValidAnalysedExposed Kubernetes API - RCE/Exposed CredsSnapchat · Command and Code Injection · 2021 · needs: no account · Missing authorisation check, OS command injection, Leaked secret or key$25,0001,191votes
#2293343ValidAnalysedAccount Takeover via Password Reset without user interactionsGitLab · Access Control · 2025 · Critical · needs: no account · Account takeover chain, Password reset flaw, Parameter pollution$35,000989votes
#925585ValidAnalysedRCE via npm misconfig -- installing internal libraries from the public registryPayPal · Command and Code Injection · 2021 · needs: no account · Dependency confusion / supply chain$30,000946votes
#737140ValidAnalysedMass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookiesSlack · Injection and Smuggling · 2020 · needs: no account · Request smuggling, Account takeover chain, Information disclosure–870votes
#622122ValidAnalysedDoS on PayPal via web cache poisoningPayPal · Denial of Service · 2019 · needs: no account · Cache poisoning, Denial of service, Request smuggling$9,700851votes
#228648ValidAnalysedWannaCrypt “Killswitch”HackerOne · No weakness recorded · 2017 · needs: no account · Business logic flaw–809votes
#531051ValidAnalysedSQL Injection Extracts Starbucks Enterprise Accounting, Financial, Payroll DatabaseStarbucks · SQL Injection · 2019 · needs: no account · SQL injection–801votes
#335330ValidAnalysedSubdomain Takeover to Authentication bypassRoblox · No weakness recorded · 2020 · needs: no account · Subdomain takeover, Blind XSS, CORS misconfiguration, Account takeover chain–783votes
#716292ValidAnalysedJumpCloud API Key leaked via Open Github Repository.Starbucks · Authentication · 2019 · needs: no account · Leaked secret or key, Missing authorisation check–739votes
#297478ValidAnalysedSQL injection in https://labs.data.gov/dashboard/datagov/csv_to_json via User-agentGSA Bounty · SQL Injection · 2019 · needs: no account · SQL injection–699votes
#488147ValidAnalysedStored XSS on https://paypal.com/signin via cache poisoningPayPal · Injection and Smuggling · 2019 · needs: no account · Request smuggling, Cache poisoning$18,900685votes
#542340ValidAnalysedSensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameterUber · Information Disclosure · 2019 · needs: no account · Missing authorisation check, IDOR / object reference, Leaked secret or key–643votes
#322985ValidAnalysedAbility to reset password for accountUpserve · Access Control · 2019 · needs: no account · Authentication bypass, Business logic flaw–637votes
#3000510ValidAnalysedThe /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is presentHackerOne · Information Disclosure · 2025 · Critical · needs: no account · Information disclosure–625votes
#396467ValidAnalysedGithub Token Leaked publicly for https://github.sc-corp.netSnapchat · Cryptography · 2018 · needs: no account · Leaked secret or key–582votes
#502758ValidAnalysedRCE and Complete Server Takeover of http://www.█████.starbucks.com.sg/Starbucks · Command and Code Injection · 2019 · needs: no account · Path traversal, Unsafe deserialisation, Code injection / eval, Missing authorisation check–572votes
#313457ValidAnalysedPublicly accessible Continuous Integration ToolSnapchat · Access Control · 2021 · needs: no account · Missing authorisation check, Information disclosure, Leaked secret or key–562votes
#401793ValidAnalysed[Grab Android/iOS] Insecure deeplink leads to sensitive information disclosureGrab · Cross-site Scripting · 2019 · needs: no account · Deep link abuse, Information disclosure–552votes
#2262382ValidAnalysedServer Side Request Forgery (SSRF) via Analytics ReportsHackerOne · Server-Side Request Forgery · 2023 · needs: no account · SSRF$25,000529votes
#1567186ValidAnalysedOne-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.comReddit · Access Control · 2022 · needs: no account · OAuth state or flow flaw, OAuth redirect_uri abuse, Account takeover chain–509votes
#698579ValidAnalysedAble to Become Admin for Any LINE Official AccountLY Corporation · Access Control · 2020 · needs: no account · IDOR / object reference, Missing authorisation check, Privilege escalation–493votes
#697099ValidAnalysedReflected XSS in OAUTH2 login flowLY Corporation · Cross-site Scripting · 2020 · needs: no account · Reflected XSS$1,990489votes
#968082ValidAnalysedCross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data ExfiltrationTikTok · Cross-site Scripting · 2020 · needs: no account · Reflected XSS, CSRF, Account takeover chain–473votes
#684092ValidAnalysedSteal ALL collateral during liquidation by exploiting lack of validation in `flip.kick`BlockDev Sp. Z o.o · Input Validation and Logic · 2019 · needs: no account · Missing authorisation check, Business logic flaw–466votes
#663628ValidAnalysedAccess to multiple production Grafana dashboardsSnapchat · Information Disclosure · 2020 · needs: no account · Missing authorisation check, Information disclosure, SQL injection$10,000464votes
#591813ValidAnalysed[Pre-Submission][H1-4420-2019] API access to Phabricator on code.uberinternal.com from leaked certificate in git repoUber · Information Disclosure · 2021 · needs: no account · Leaked secret or key$40,000458votes
#146336ValidAnalysedXSS vulnerable parameter in a location hashSlack · Cross-site Scripting · 2019 · needs: no account · Reflected XSS–455votes
#1888915ValidAnalysedReset password link sent over unsecured http protocolMattermost · Access Control · 2023 · needs: no account · Password reset flaw, Account takeover chain$750440votes
#446271ValidAnalysedCRLF injectionX / xAI · No weakness recorded · 2019 · needs: no account · CRLF / header injection–439votes
#202781ValidAnalysedChained Bugs to Leak Victim's Uber's FB Oauth TokenUber · Authentication · 2019 · needs: no account · OAuth redirect_uri abuse, Account takeover chain–427votes
#631956ValidAnalysedPanorama UI XSS leads to Remote Code Execution via Kick/Disconnect MessageValve · Command and Code Injection · 2019 · needs: no account · Stored XSS, Code injection / eval–420votes
#314808ValidAnalysedFull account takeoverReverb.com · Access Control · 2020 · needs: no account · Authentication bypass, OAuth state or flow flaw, Account takeover chain–412votes
#496937ValidAnalysedEmployee's GitHub Token Found In Travis CI Build LogsSuperhuman (formerly Grammarly) · Information Disclosure · 2019 · needs: no account · Leaked secret or key, Information disclosure$5,000408votes
#591302ValidAnalysedDenial of service to WP-JSON API by cache poisoning the CORS allow origin headerAutomattic · Denial of Service · 2020 · needs: no account · Cache poisoning, Denial of service, CORS misconfiguration–405votes
#1962645ValidAnalysed[accounts.reddit.com] Redirect parameter allows for XSSReddit · Cross-site Scripting · 2023 · needs: no account · Reflected XSS, Open redirect$5,000394votes
#840759ValidAnalysedReflected XSS on www.hackerone.com and resources.hackerone.comHackerOne · Cross-site Scripting · 2020 · needs: no account · Reflected XSS$500387votes
#946409ValidAnalysedRCE on build server via misconfigured pip installYelp · Supply Chain and Malicious Code · 2021 · needs: no account · Code injection / eval, Dependency confusion / supply chain–366votes
#3782701ValidAnalysedUnauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where)Mozilla · Command and Code Injection · 2026 · Critical · needs: no account · Code injection / eval, Missing authorisation check, Leaked secret or key$12,000361votes
#982291ValidAnalysedHEY.com email stored XSSBasecamp · Cross-site Scripting · 2020 · needs: no account · Stored XSS, HTML injection, CSRF$5,000360votes
#1207040ValidAnalysedBlind XSS on Twitter's internal Big Data panel at █████████████X / xAI · Cross-site Scripting · 2021 · needs: no account · Stored XSS, Blind XSS–357votes
#905607ValidAnalysed[cs.money] Open Redirect Leads to Account TakeoverCS Money · Authentication · 2020 · needs: no account · Open redirect, OAuth redirect_uri abuse, Account takeover chain, Leaked secret or key–357votes
#1350887ValidAnalysedReflected XSS in TikTok endpointsTikTok · Cross-site Scripting · 2021 · needs: no account · Reflected XSS–356votes
#1960765ValidAnalysedBlind SSRF to internal services in matrix preview_link APIReddit · Server-Side Request Forgery · 2023 · needs: no account · SSRF, SSRF through a redirect, Information disclosure$6,000344votes
#676212ValidAnalysedGithub information leakedSemrush · Information Disclosure · 2019 · needs: no account · Information disclosure–344votes

The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.