Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Improper Authentication - any user can login as other user with otp/logout & otp/loginAnalysed#921780 | Valid | Authentication | – | 2021-09-03 | – | 972 |
| Delete anyone's content spotlight remotely.Analysed#1819832 | Valid | Insecure Direct Object Reference | – | 2023-03-06 | $15,000 | 801 |
| Open prod Jenkins instanceAnalysed#231460 | Valid | Information Disclosure | – | 2017-08-19 | $15,000 | 436 |
| Server-Side Request Forgery using Javascript allows to exfill data from Google MetadataAnalysed#530974 | Valid | Server-Side Request Forgery | – | 2020-11-30 | – | 421 |
| Stealing SSO Login Tokens (snappublisher.snapchat.com)Analysed#265943 | Valid | Authentication | – | 2021-07-29 | $7,500 | 244 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.