Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Exposed Kubernetes API - RCE/Exposed CredsAnalysed#455645 | Valid | Command and Code Injection | Critical | 2021-07-29 | $25,000 | 1,191 |
| Github Token Leaked publicly for https://github.sc-corp.netAnalysed#396467 | Valid | Cryptography | Critical | 2018-10-08 | – | 582 |
| Publicly accessible Continuous Integration ToolAnalysed#313457 | Valid | Access Control | Critical | 2021-07-29 | – | 562 |
| Access to multiple production Grafana dashboardsAnalysed#663628 | Valid | Information Disclosure | High | 2020-11-04 | $10,000 | 464 |
| Leaked JFrog Artifactory username and password exposed on GitHub - https://snapchat.jfrog.ioAnalysed#911606 | Valid | Information Disclosure | High | 2021-08-12 | $15,000 | 137 |
| Subdomain takeover on http://fastly.sc-cdn.net/Analysed#154425 | Valid | Misconfiguration and Insecure Design | – | 2016-08-22 | $3,000 | 114 |
| internal dev tokens disclosureAnalysed#1940443 | Valid | Cryptography | Low | 2023-06-14 | $250 | 96 |
| Bitmoji source code is accessibleAnalysed#301812 | Valid | Information Disclosure | Medium | 2021-07-31 | $1,000 | 92 |
| Administrator access to a Django Administration Panel on *.sc-corp.net via bruteforced credentialsAnalysed#128114 | Valid | Authentication | – | 2016-07-14 | $1,000 | 54 |
| CreatorID leaked from public content posted to SnapMapsAnalysed#867521 | Valid | Server-Side Request Forgery | Medium | 2020-12-18 | $1,000 | 49 |
| Bypass Rate Limits on app.snapchat.com API Endpoint via X-Forwarded-For HeaderAnalysed#727487 | Valid | Input Validation and Logic | Medium | 2021-08-04 | – | 40 |
| Client IP Spoofing using "X-Forwarded-For: 127.0.0.1" on "studio-app.snapchat.com" exposing bucket detailsAnalysed#382678 | Valid | Access Control | High | 2021-08-12 | $500 | 40 |
| Subdomain Takeover via Unclaimed WordPress siteAnalysed#274336 | Valid | Authentication | Medium | 2017-10-06 | – | 39 |
| XSS found on Snapchat websiteAnalysed#125849 | Valid | Cross-site Scripting | – | 2018-05-26 | – | 38 |
| Domain Takeover in [obviousengine.com] a snapchat acquisitionsAnalysed#392785 | Valid | Access Control | High | 2018-10-07 | – | 32 |
| Incoming email hijacking on sc-cdn.netAnalysed#168476 | Valid | Misconfiguration and Insecure Design | – | 2016-09-23 | – | 25 |
| CRLF Injection at vpn.bitstrips.comAnalysed#237357 | Valid | Injection and Smuggling | Medium | 2017-06-15 | – | 24 |
| CSRF when unlocking lenses leads to lenses being forcefully installed without user interactionAnalysed#1085336 | Valid | Cross-Site Request Forgery | Low | 2021-07-29 | $250 | 21 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.