Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Account takeover via insecure intent handlingAnalysed#2516732	Valid	Deserialization and Object Injection	Medium	2024-05-30	–	136
stored XSS in hey.com message contentAnalysed#988272	Valid	Cross-site Scripting	Medium	2020-10-31	–	80
Path traversal in deeplink query parameter can expose any user's private info to a public directory (one click)Analysed#2553411	Valid	File and Path Handling	Medium	2024-07-09	–	65
Link unfurling calls out to arbitrary URLs and the private-network guard misses link-local addressesAnalysed#3445890	Valid	Server-Side Request Forgery	Medium	2025-12-22	–	62
DNS Setup allows sending mail on behalf of other customersAnalysed#981824	Valid	Misconfiguration and Insecure Design	Medium	2021-02-21	–	58
Navgraph confusion allows any 3p app to send and read requests from the server at app.hey.comAnalysed#2552879	Valid	Deserialization and Object Injection	Medium	2024-07-09	–	31
Improper Authentication via previous backup code loginAnalysed#1485788	Valid	Authentication	Medium	2022-03-24	–	24
Bypass Tracking Blocker Protection Using Slashes Without Protocol On The Image Source.Analysed#1050656	Valid	No weakness recorded	Medium	2020-12-17	–	17

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.