Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Fee discounts can be redeemed many times, resulting in unlimited fee-free transactionsAnalysed#1849626 | Valid | Input Validation and Logic | Medium | 2023-02-25 | $5,000 | 266 |
| Mass Account Takeover at https://app.taxjar.com/ - No user InteractionAnalysed#1581240 | Valid | Authentication | Critical | 2022-07-11 | – | 253 |
| Possible XSS vulnerability without a content security bypassAnalysed#1804177 | Valid | Cross-site Scripting | Medium | 2023-05-01 | $2,000 | 131 |
| User can pay using archived price by manipulating the request sent to `POST /v1/payment_pages/for_plink`Analysed#1328278 | Valid | Insecure Direct Object Reference | Medium | 2022-01-19 | – | 100 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,443 analysed so far), which can be wrong. Data as of 2026-11-14.