Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Employee's GitHub Token Found In Travis CI Build LogsAnalysed#496937	Valid	Information Disclosure	High	2019-05-22	$5,000	408
Account takeover through the combination of cookie manipulation and XSSAnalysed#534450	Valid	Cross-site Scripting	High	2019-12-03	–	292
Config override using non-validated query parameter allows at least reflected XSS by injecting configuration into stateAnalysed#1082847	Valid	Input Validation and Logic	Medium	2021-03-01	–	223
`socket` command allows sending data over WebSockets to arbitrary origins from Grammarly ExtensionAnalysed#395729	Valid	No weakness recorded	High	2019-07-15	–	140
Unauthenticated users can access all food.grammarly.io user's dataAnalysed#745495	Valid	Access Control	Low	2020-08-10	–	138
Use Github pack with Coda employee github account (search code of Coda's private repositories)Analysed#676581	Valid	No weakness recorded	Medium	2020-01-02	–	104
Grammarly Keyboard for Android "Authorization Code with PKCE" flow implementation vulnerability that allows account takeoverAnalysed#824931	Valid	Cryptography	Medium	2020-07-24	–	76
DOM based CSS Injection on grammarly.comAnalysed#500436	Valid	Cross-site Scripting	Low	2019-05-06	$250	63

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.