Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Markdown parsing issue enables insertion of malicious tags and event handlersAnalysed#299728	Valid	Cross-site Scripting	High	2018-01-29	$5,000	184
Team object in GraphQL discloses team group names and permissionsAnalysed#343464	Valid	Information Disclosure	Medium	2018-05-04	$2,500	75
The request tells the number of private programs, the new system of authorization /invite/tokenAnalysed#310946	Valid	Information Disclosure	Medium	2018-02-14	$2,000	71
TeamProfile exposes partially sensitive information through GraphQLAnalysed#389600	Valid	Information Disclosure	Low	2018-08-08	–	60
Team object in GraphQL that have a published external program may expose existence of a private programAnalysed#347937	Valid	Information Disclosure	None	2018-07-04	–	39
Internal usage of AdBlockPlus may expose PoC URLs to unknown third-partiesAnalysed#395518	Valid	Information Disclosure	Low	2018-08-17	–	32
Unicorn worker pool exhaustion by continuously updating payout preferencesAnalysed#317543	Valid	Denial of Service	Medium	2018-03-30	–	25

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.