Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Improper Authentication - any user can login as other user with otp/logout & otp/loginAnalysed#921780 | Valid | Authentication | Critical | 2021-09-03 | – | 972 |
| Delete anyone's content spotlight remotely.Analysed#1819832 | Valid | Insecure Direct Object Reference | High | 2023-03-06 | $15,000 | 801 |
| Open prod Jenkins instanceAnalysed#231460 | Valid | Information Disclosure | High | 2017-08-19 | $15,000 | 436 |
| Server-Side Request Forgery using Javascript allows to exfill data from Google MetadataAnalysed#530974 | Valid | Server-Side Request Forgery | – | 2020-11-30 | – | 421 |
| Stealing SSO Login Tokens (snappublisher.snapchat.com)Analysed#265943 | Valid | Authentication | High | 2021-07-29 | $7,500 | 244 |
| Intent Leads To Unauthorised Video Call Initiation Leaking Surrounding Informations Of VictimAnalysed#2139260 | Valid | Information Disclosure | Medium | 2024-04-05 | – | 127 |
| RCE/LFI on test Jenkins instance due to improper authentication flowAnalysed#258117 | Valid | Access Control | Medium | 2017-08-19 | – | 118 |
| Password reset tokens sent to CSP reporting endpointsAnalysed#1626281 | Valid | Information Disclosure | Low | 2022-08-31 | – | 26 |
| Organization Members in Snap Kit may Deactivate AppsAnalysed#1103448 | Valid | Access Control | Low | 2021-08-26 | – | 26 |
| [spectacles.com] Bypassing quantity limit in ordersAnalysed#246803 | Valid | Injection and Smuggling | Medium | 2017-08-12 | $250 | 22 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.