WannaCrypt “Killswitch” Analysed #228648 Valid No weakness recorded – 2017-05-13 – 809 Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONP Analysed #207042 Valid Misconfiguration and Insecure Design – 2017-08-29 – 153 A HackerOne employee's GitHub personal access token exposed in Travis CI build logs Analysed #215625 Valid Information Disclosure Medium 2017-05-23 $2,000 75 Homograph fix Bypass Analysed #271324 Valid Misconfiguration and Insecure Design Medium 2017-10-16 – 71 Query parameter reordering causes redirect page to render unsafe URL Analysed #293689 Valid Cross-site Scripting Medium 2017-11-30 $1,500 61 Invalid Host detection at https://hackerone.com/redirect Analysed #278095 Valid Misconfiguration and Insecure Design Low 2017-12-03 – 57 Content Security Policy not applied to error pages at multiple HackerOne endpoints Analysed #250729 Valid Misconfiguration and Insecure Design Low 2017-12-12 – 45 Changing Victim's JIRA Integration Settings Through Multiple Bugs Analysed #226199 Valid Input Validation and Logic Medium 2017-05-23 $1,000 36 Program profile metrics endpoint contains mean time to triage, even when turned off Analysed #289568 Valid Information Disclosure Medium 2017-11-14 – 29 resolved bugs in a program are public despite the program settings Analysed #270993 Valid Information Disclosure Low 2017-10-13 – 25 Lack of input sanitization in Marketo form leads to execution of HTML in lead emails Analysed #220009 Valid Server-Side Request Forgery – 2017-10-03 $500 25 CRLF injection in info.hacker.one Analysed #217058 Valid Injection and Smuggling – 2017-05-03 – 21 Able to create basic user account via Google login on HackerOne Drupal CMS Analysed #208407 Valid Authentication – 2017-04-25 – 20 Missing Certificate Authority Authorization rule Analysed #129992 Valid Cryptography – 2017-08-17 – 20 Insecure SHA1withRSA in b5s.hackerone-ext-content.com and a4l.hackerone-ext-content.com Analysed #225754 Valid Cryptography – 2017-06-21 – 19 Limited Open redirection using SSO-SAML Analysed #178345 Valid Open Redirect Low 2017-03-26 – 19 www.hackerone.com website CSP "script-src" includes "unsafe-inline" Analysed #225833 Valid Misconfiguration and Insecure Design None 2017-05-23 – 17 Example HackerOne security@ forward domain is not registered Analysed #218705 Valid Misconfiguration and Insecure Design – 2017-04-10 – 17