Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Snippet JS template allows attacker to read a user's private snippetsAnalysed#348443 | Valid | Information Disclosure | Low | 2019-03-03 | $300 | 165 |
| Remove obsolete domain from handbook subdomainAnalysed#2599840 | Valid | Misconfiguration and Insecure Design | Low | 2024-10-01 | – | 72 |
| Access Projects And create projects in gitlab pre production serverAnalysed#540711 | Valid | Access Control | Low | 2019-08-28 | – | 28 |
| No redirect_uri in the db for web-internal clientKey leads to one-click DoS on gitter.imAnalysed#702987 | Valid | Denial of Service | Low | 2020-05-15 | – | 26 |
| A profile page of a user can be denied from loading by appending .html to the usernameAnalysed#475098 | Valid | Misconfiguration and Insecure Design | Low | 2021-08-30 | $200 | 26 |
| Claiming package names in GitLab's automatic package referencer.Analysed#462503 | Valid | Input Validation and Logic | Low | 2019-04-05 | $1,000 | 26 |
| Last build status and coverage leaked to unauthorized usersAnalysed#477222 | Valid | Information Disclosure | Low | 2019-09-01 | – | 24 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.