Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Change phone number OTP flaw leads to any phone number takeoverAnalysed#2588329	Valid	Input Validation and Logic	Critical	2024-10-09	$2,000	241
inDriver Job - Admin Approval BypassAnalysed#1861487	Valid	Access Control	Medium	2023-07-05	$1,000	157
Unlimited fake rate to the passenger in city to city, Affected endpoint `/api/v1/reviews/ride/<ID>/driver`Analysed#2125049	Valid	Input Validation and Logic	Medium	2024-07-02	–	110
# Drivers can access the customers phone number, current location without getting their offer accepted!Analysed#1785079	Valid	Information Disclosure	Medium	2024-02-19	–	79
Rider can forcefully get passenger's order accepted resulting in multiple impacts including PII reveal and more mentioned in the report.Analysed#1960107	Valid	Access Control	High	2023-06-28	–	73
Disclosure of users' ip address whenever they view my fright offer on image preview (Without interaction)Analysed#1782467	Valid	Information Disclosure	Medium	2024-02-19	–	73

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,437 analysed so far), which can be wrong. Data as of 2026-11-15.