Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Unrestricted File Upload Leads to RCE on mobile.starbucks.com.sgAnalysed#1027822 | Valid | Access Control | Critical | 2020-12-09 | – | 247 |
| sdrc.starbucks.com - Information Disclosure via unsecured attachment directoryAnalysed#769016 | Valid | Information Disclosure | Critical | 2020-02-26 | – | 197 |
| Bug in GraphQL and API integration leads to limited user address disclosureAnalysed#473742 | Valid | Access Control | High | 2019-03-08 | – | 144 |
| Singapore - Unrestricted File Upload Leads to XSS on campaign.starbucks.com.sg/api/uploadAnalysed#883151 | Valid | Cross-site Scripting | Medium | 2020-07-22 | – | 61 |
| Parameter Manipulation allowed for editing the shipping address for other user’s teavana.com subscriptions.Analysed#141120 | Valid | Authentication | – | 2017-01-26 | – | 37 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,942 analysed so far), which can be wrong. Data as of 2026-11-15.