Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Blind Stored XSS in HackerOne's Sal 4.1.4.2149 (sal.████.com)Analysed#995995 | Valid | Cross-site Scripting | None | 2020-11-09 | – | 84 |
| Pentester can obtain information about other pentesters who applied for the same test, but weren't acceptedAnalysed#958374 | Valid | Information Disclosure | Low | 2020-08-24 | $500 | 74 |
| Making program preference -> program visibilty feature usless and disclosing API Identifier in the progress and data that may cause potential IDORS.Analysed#929361 | Valid | Information Disclosure | Low | 2020-10-02 | – | 71 |
| program_analytics_benchmarks query shows information not visible in publicAnalysed#826176 | Valid | Information Disclosure | Low | 2020-03-27 | – | 22 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.