Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
16 of 15,219 reports · $54,000 in bounties · 161 analysed so far
- #489146ValidAnalysedConfidential data of users and limited metadata of programs and reports accessible via GraphQLHackerOne · Information Disclosure · 2019 · needs: not clear from the report · Missing authorisation check, Information disclosure–1,033votes
- #740037ValidAnalysedRequest smuggling on admin-official.line.me could lead to account takeoverLY Corporation · Injection and Smuggling · 2020 · needs: not clear from the report · Request smuggling, Account takeover chain–565votes
- #409850ValidAnalysedXSS in steam react chat clientValve · Cross-site Scripting · 2019 · needs: not clear from the report · Stored XSS$7,500499votes
- #762510ValidAnalysedHow the Bug stole hackingHackerOne · Insecure Direct Object Reference · 2019 · needs: not clear from the report · Information disclosure–471votes
- #383127ValidAnalysedSQL Injection in report_xml.php through countryFilter[] parameterValve · SQL Injection · 2018 · needs: not clear from the report · SQL injection$25,000410votes
- #340431ValidAnalysedReflected XSS and sensitive data exposure, including payment details, on lioncityrentals.com.sgUber · Cryptography · 2020 · needs: not clear from the report · Reflected XSS, Information disclosure$4,000376votes
- #1065500ValidAnalysedMultiple bugs leads to RCE on TikTok for AndroidTikTok · Access Control · 2021 · needs: not clear from the report · Reflected XSS–371votes
- #1010522ValidAnalysed[CSRF] TikTok Careers Portal Account TakeoverTikTok · Cross-Site Request Forgery · 2020 · needs: not clear from the report · CSRF, Open redirect, Account takeover chain–366votes
- #590020ValidAnalysedCRLF Injection in urllibInternet Bug Bounty · Injection and Smuggling · 2020 · needs: not clear from the report · CRLF / header injection, SSRF$1,000341votes
- #403616ValidAnalysed[www.zomato.com] SQLi - /php/██████████ - item_idEternal · SQL Injection · 2018 · needs: not clear from the report · SQL injection$4,500326votes
- #761304ValidAnalysedSQL Injection on cookie parameterMTN Group · SQL Injection · 2020 · needs: not clear from the report · SQL injection–323votes
- #333419ValidAnalysedTURN server allows TCP and UDP proxying to internal network, localhost and meta-data servicesSlack · Server-Side Request Forgery · 2020 · needs: not clear from the report · SSRF, Information disclosure$3,500323votes
- #739601ValidAnalysedReflected XSSBumble · Cross-site Scripting · 2019 · needs: not clear from the report · Reflected XSS$1,000317votes
- #1024575ValidAnalysedRCE on TikTok Ads PortalTikTok · Command and Code Injection · 2021 · needs: not clear from the report · OS command injection–312votes
- #807924ValidAnalysedCSRF on connecting Paypal as Payment ProviderShopify · Cross-Site Request Forgery · 2020 · needs: not clear from the report · CSRF, Business logic flaw–304votes
- #1211724ValidAnalysedHTTP Request Smuggling via HTTP/2Basecamp · Injection and Smuggling · 2021 · needs: not clear from the report · Request smuggling$7,500300votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.