Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Private program disclosure via `vpn_suspended` GraphQL queryAnalysed#715192	Valid	Information Disclosure	None	2019-10-21	$2,500	138
Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?)Analysed#170310	Valid	Misconfiguration and Insecure Design	None	2016-12-08	–	76
Deprecated Hacker101 coursework repository mentions Heroku App that is susceptible to takeoverAnalysed#514451	Valid	Server-Side Request Forgery	None	2019-04-04	$500	68
HTTP Parameter Pollution using semicolons in iframe element at hackerone.com/careers allows loading external Greenhouse formsAnalysed#298265	Valid	No weakness recorded	None	2018-03-13	–	65
HackerOne customer submitted sensitive link to VirusTotal, exposing confidential informationAnalysed#378122	Valid	Information Disclosure	None	2018-07-26	–	60
Register & create a ticket as somebody else on HackerOne SupportAnalysed#2082680	Valid	Misconfiguration and Insecure Design	None	2023-07-31	–	56
Open Redirect on http://events.hackerone.com/redirect?url=https://naglinagli.github.ioAnalysed#1028345	Valid	Open Redirect	None	2021-03-26	–	54
Open Redirection in index.php pageAnalysed#320376	Valid	Open Redirect	None	2018-03-07	–	53
Open redirect vulnerability in index.phpAnalysed#439075	Valid	Open Redirect	None	2019-02-03	–	39
Open Redirection in [https://www.hackerone.com/index.php]Analysed#562417	Valid	Open Redirect	None	2019-05-08	–	33
Program profile_metrics.json contains time to triage for deptofdefense even it's turned offAnalysed#318399	Valid	Information Disclosure	None	2018-03-09	$250	27
Used email confirmation link reveals the email address which is tied to itAnalysed#1128358	Valid	Information Disclosure	None	2021-09-22	–	21
Missing Certificate Authority Authorization ruleAnalysed#410245	Valid	Cryptography	None	2019-04-11	–	17
www.hackerone.com website CSP "script-src" includes "unsafe-inline"Analysed#225833	Valid	Misconfiguration and Insecure Design	None	2017-05-23	–	17

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.