Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Mass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookiesAnalysed#737140 | Valid | Injection and Smuggling | Critical | 2020-03-12 | – | 870 |
| XSS vulnerable parameter in a location hashAnalysed#146336 | Valid | Cross-site Scripting | – | 2019-10-16 | – | 455 |
| AWS bucket leading to iOS test build code and configuration exposureAnalysed#404822 | Valid | Information Disclosure | Critical | 2019-02-23 | $1,500 | 321 |
| Slack DTLS uses a private key that is in the public domain, which may lead to SRTP stream hijackAnalysed#531032 | Valid | Cryptography | High | 2020-03-12 | $2,000 | 170 |
| Unauthenticated LFI revealing log informationAnalysed#272578 | Valid | Information Disclosure | High | 2018-01-26 | – | 123 |
| Stealing xoxs-tokens using weak postMessage / call-popup redirect to current team domainAnalysed#207170 | Valid | Misconfiguration and Insecure Design | – | 2017-02-28 | – | 120 |
| SSRF via Office file thumbnailsAnalysed#671935 | Valid | Information Disclosure | Critical | 2022-07-05 | $4,000 | 109 |
| Real Time Error Logs Through Debug InformationAnalysed#503283 | Valid | Information Disclosure | High | 2019-04-11 | – | 100 |
| User-assisted RCE in Slack for macOS (from official site) due to improper quarantine meta-attribute handling for downloaded filesAnalysed#470637 | Valid | No weakness recorded | High | 2019-09-14 | – | 97 |
| OSX slack:// protocol handler javascript injectionAnalysed#79348 | Valid | Command and Code Injection | – | 2016-06-24 | – | 72 |
| The Custom Emoji Page has a Reflected XSSAnalysed#258198 | Valid | Cross-site Scripting | High | 2017-09-24 | – | 56 |
| XSS on link and window.openerAnalysed#834071 | Valid | Cross-site Scripting | Medium | 2023-01-23 | $1,000 | 49 |
| The POODLE attack (SSLv3 supported) at status.slack.comAnalysed#375097 | Valid | Cryptography | Medium | 2018-11-28 | – | 44 |
| Information leakage and default open portAnalysed#305518 | Valid | No weakness recorded | Low | 2019-06-22 | – | 41 |
| Slack-Corp Heroku application disclosing limited info about company membersAnalysed#966814 | Valid | Information Disclosure | Low | 2020-12-09 | – | 39 |
| Workspace configuration metadata disclosureAnalysed#864489 | Valid | Information Disclosure | High | 2022-04-01 | – | 39 |
| Private application files can be uploaded to Slack via malicious uploaderAnalysed#375083 | Valid | Information Disclosure | Medium | 2021-08-04 | $500 | 38 |
| Subdomain takeover on podcasts.slack-core.comAnalysed#195350 | Valid | Cross-site Scripting | Low | 2017-01-04 | $100 | 27 |
| HTTP parameter pollution from outdated Greenhouse.io JS dependencyAnalysed#335339 | Valid | Injection and Smuggling | Medium | 2018-07-19 | – | 26 |
| Source code leakage through GIT web access at host '52.91.137.42'Analysed#148068 | Valid | Authentication | – | 2016-08-15 | – | 26 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.