Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Improperly validated fields allows injection of arbitrary HTML via spoofed React objectsAnalysed#49652 | Valid | Cross-site Scripting | High | 2015-03-18 | $5,000 | 23 |
| Vulnerability with the way \ escaped characters in <http://danlec.com> style links are renderedAnalysed#46072 | Valid | Cross-site Scripting | High | 2015-02-03 | $5,000 | 21 |
| PNG compression DoSAnalysed#454 | Valid | Denial of Service | – | 2015-05-28 | $500 | 18 |
| Pre-generation of 2FA secret/backup codes seems like an unnecessary riskAnalysed#100509 | Valid | No weakness recorded | – | 2015-12-02 | $1,000 | 15 |
| Logical issues with account settingsAnalysed#546 | Valid | Misconfiguration and Insecure Design | – | 2015-05-28 | – | 15 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.