Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Information Disclosure in /skills callAnalysed#188719 | Valid | Information Disclosure | Medium | 2017-01-05 | $10,000 | 287 |
| Disclose any user's private email through APIAnalysed#196655 | Valid | Information Disclosure | Medium | 2017-02-24 | – | 140 |
| Subdomain takeover at info.hacker.oneAnalysed#202767 | Valid | Access Control | Low | 2017-03-27 | – | 134 |
| Reading redacted data via hackbot's answersAnalysed#247628 | Valid | Information Disclosure | Medium | 2017-07-27 | $1,500 | 93 |
| IDOR on HackerOne Feedback ReviewAnalysed#262661 | Valid | Insecure Direct Object Reference | Low | 2017-09-02 | – | 79 |
| Subdomain takeover #2 at info.hacker.oneAnalysed#209004 | Valid | Access Control | Low | 2017-04-28 | – | 78 |
| Validation message in Bounty award endpoint can be used to determine program balancesAnalysed#293299 | Valid | Information Disclosure | Medium | 2017-11-29 | – | 73 |
| Race condition leads to duplicate payoutsAnalysed#220445 | Valid | Access Control | Low | 2017-05-23 | – | 73 |
| Report Private Links Leaks to Google Analytics via Query String ParamAnalysed#269479 | Valid | Information Disclosure | Medium | 2017-10-25 | – | 59 |
| Subdomain takeover #3 at info.hacker.oneAnalysed#217358 | Valid | Access Control | Low | 2017-06-21 | – | 58 |
| Subdomain takeover #4 at info.hacker.oneAnalysed#220002 | Valid | Access Control | Low | 2017-06-21 | – | 50 |
| Websites opened from reports can change url of report pageAnalysed#189726 | Valid | Open Redirect | Medium | 2017-02-25 | – | 50 |
| Google Analytics could be used as CSP bypass for data exfiltration on hackerone.comAnalysed#199779 | Valid | Misconfiguration and Insecure Design | Low | 2017-03-26 | – | 44 |
| Invitation tokens leak to Google AnalyticsAnalysed#237262 | Valid | Information Disclosure | Low | 2017-07-16 | – | 32 |
| Blind SSRF in "Integrations" by abusing a bug in Ruby's native resolver.Analysed#287245 | Valid | Server-Side Request Forgery | – | 2017-11-09 | – | 30 |
| Information leakage via CSV when content is valid JavaScriptAnalysed#207266 | Valid | Cross-Site Request Forgery | Low | 2017-05-23 | – | 29 |
| Report redaction doesn't apply to report title update activitiesAnalysed#196358 | Valid | Misconfiguration and Insecure Design | Low | 2017-02-25 | – | 27 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,614 analysed so far), which can be wrong. Data as of 2026-11-15.