Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| RCE on build server via misconfigured pip installAnalysed#946409 | Valid | Supply Chain and Malicious Code | Critical | 2021-02-09 | – | 366 |
| yelp.com XSS ATO (via login keylogger, link Google account)Analysed#2010530 | Valid | Cross-site Scripting | High | 2023-08-15 | – | 324 |
| Object Level access control leads to reading user's full requests, sessions, and error messagesAnalysed#2891449 | Valid | Access Control | Medium | 2025-01-18 | – | 113 |
| Access to internal CMS containing private DataAnalysed#100926 | Valid | Authentication | – | 2016-10-07 | – | 83 |
| X-Forward-For Header allows to bypass access restrictionsAnalysed#1011767 | Valid | Access Control | Medium | 2020-10-26 | – | 73 |
| RXSS AT https://proze.yelp.com/tmsubscribe.net/vidsn.aspxAnalysed#2947762 | Valid | Cross-site Scripting | Medium | 2025-06-30 | – | 56 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.