Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Takeover an account that doesn't have a Shopify ID and moreAnalysed#867513 | Valid | Shopify | No weakness recorded | Critical | 2020-09-02 | – | 3,006 |
| Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSOAnalysed#791775 | Valid | Shopify | No weakness recorded | Critical | 2020-04-01 | – | 1,922 |
| Arbitrary file read via the UploadsRewriter when moving and issueAnalysed#827052 | Valid | GitLab | File and Path Handling | Critical | 2020-04-27 | $20,000 | 1,503 |
| Improper Authentication - any user can login as other user with otp/logout & otp/loginAnalysed#921780 | Valid | Snapchat | Authentication | Critical | 2021-09-03 | – | 972 |
| [Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege EscalationAnalysed#796808 | Valid | Shopify | No weakness recorded | Critical | 2020-04-01 | – | 894 |
| H1514 Remote Code Execution on kitcrm using bulk customer update of Priority ProductsAnalysed#422944 | Valid | Shopify | Command and Code Injection | Medium | 2020-02-06 | – | 830 |
| Remote Code Execution on www.semrush.com/my_reports on Logo uploadAnalysed#403417 | Valid | Semrush | Command and Code Injection | Critical | 2019-06-24 | – | 824 |
| Delete anyone's content spotlight remotely.Analysed#1819832 | Valid | Snapchat | Insecure Direct Object Reference | High | 2023-03-06 | $15,000 | 801 |
| IDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/usersAnalysed#415081 | Valid | PayPal | Insecure Direct Object Reference | High | 2019-07-30 | $10,500 | 797 |
| Websites Can Run Arbitrary Code on Machines Running the 'PlayStation Now' ApplicationAnalysed#873614 | Valid | PlayStation | Command and Code Injection | Critical | 2020-12-04 | $15,000 | 780 |
| Git flag injection - local file overwrite to remote code executionAnalysed#658013 | Valid | GitLab | Command and Code Injection | Critical | 2019-12-19 | $12,000 | 777 |
| Exfiltrate and mutate repository and project data through injected templated serviceAnalysed#446585 | Valid | GitLab | Access Control | Critical | 2019-03-05 | $11,000 | 762 |
| Use-After-Free In IPV6_2292PKTOPTIONS leading To Arbitrary Kernel R/W PrimitivesAnalysed#826026 | Valid | PlayStation | Memory Corruption | High | 2020-07-06 | $10,000 | 741 |
| Webshell via File Upload on ecjobs.starbucks.com.cnAnalysed#506646 | Valid | Starbucks | Command and Code Injection | Critical | 2019-11-13 | – | 688 |
| Email address of any user can be queried on Report Invitation GraphQL type when username is knownAnalysed#792927 | Valid | HackerOne | Access Control | High | 2020-02-20 | – | 671 |
| Getting all the CD keys of any gameAnalysed#391217 | Valid | Valve | Access Control | Critical | 2018-10-31 | $20,000 | 638 |
| Stored XSS in Wiki pagesAnalysed#526325 | Valid | GitLab | Cross-site Scripting | High | 2019-09-02 | – | 633 |
| Bypassing Digits origin validation which leads to account takeoverAnalysed#129873 | Valid | X / xAI | Authentication | – | 2020-06-24 | – | 619 |
| Stored XSS on imgur profileAnalysed#484434 | Valid | Imgur | Cross-site Scripting | Medium | 2019-03-02 | – | 614 |
| Customer private program can disclose email any users through invited via usernameAnalysed#807448 | Valid | HackerOne | Information Disclosure | High | 2020-05-15 | $7,500 | 589 |
| The return of the ＜Analysed#639684 | Valid | Rockstar Games | Cross-site Scripting | High | 2019-09-24 | $1,000 | 576 |
| Email Confirmation Bypass in your-store.myshopify.com which leads to privilege escalationAnalysed#910300 | Valid | Shopify | Access Control | Critical | 2020-09-15 | – | 559 |
| Privilege Escalation From user to SYSTEM via unauthenticated command executionAnalysed#544928 | Valid | Ubiquiti Inc. | Command and Code Injection | Critical | 2019-11-08 | – | 553 |
| Local files could be overwritten in GitLab, leading to remote command executionAnalysed#587854 | Valid | GitLab | Command and Code Injection | Critical | 2019-07-17 | $12,000 | 542 |
| Shopify Stocky App OAuth MisconfigurationAnalysed#740989 | Valid | Shopify | Access Control | Medium | 2019-12-11 | – | 527 |
| Remote Code Execution in Slack desktop apps + bonusAnalysed#783877 | Valid | Slack | Command and Code Injection | Critical | 2020-08-28 | – | 509 |
| RCE when removing metadata with ExifToolAnalysed#1154542 | Valid | GitLab | Command and Code Injection | Critical | 2021-05-14 | $20,000 | 508 |
| profile-picture name parameter with large value lead to DoS for other users and programs on the platformAnalysed#764434 | Valid | HackerOne | Denial of Service | Medium | 2020-03-25 | – | 475 |
| Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requestsAnalysed#689314 | Valid | GitLab | Access Control | Critical | 2019-11-27 | $12,000 | 457 |
| Blind XSS on image uploadAnalysed#1010466 | Valid | CS Money | Cross-site Scripting | Critical | 2020-12-26 | $1,000 | 450 |
| Modify in-flight data to payment provider Smart2PayAnalysed#1295844 | Valid | Valve | Input Validation and Logic | Critical | 2021-08-10 | $7,500 | 443 |
| Flickr Account Takeover using AWS Cognito APIAnalysed#1342088 | Valid | Flickr | Authentication | Critical | 2021-12-18 | – | 440 |
| Open prod Jenkins instanceAnalysed#231460 | Valid | Snapchat | Information Disclosure | High | 2017-08-19 | $15,000 | 436 |
| An attacker can can view any hacker email via /SaveCollaboratorsMutation operation nameAnalysed#2032716 | Valid | HackerOne | Information Disclosure | High | 2023-07-04 | $12,500 | 429 |
| RCE via unsafe inline Kramdown options when rendering certain Wiki pagesAnalysed#1125425 | Valid | GitLab | Command and Code Injection | Critical | 2021-04-20 | $20,000 | 427 |
| Server-Side Request Forgery using Javascript allows to exfill data from Google MetadataAnalysed#530974 | Valid | Snapchat | Server-Side Request Forgery | – | 2020-11-30 | – | 421 |
| Remote code execution on Basecamp.comAnalysed#365271 | Valid | Basecamp | Command and Code Injection | Critical | 2020-11-26 | $5,000 | 417 |
| gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be readAnalysed#850447 | Valid | GitLab | Information Disclosure | Critical | 2020-06-08 | $10,000 | 410 |
| H1514 Server Side Template Injection in Return Magic email templates?Analysed#423541 | Valid | Shopify | Command and Code Injection | – | 2019-04-04 | – | 409 |
| Stored XSS VulnerabilityAnalysed#643908 | Valid | WordPress | Cross-site Scripting | High | 2019-07-18 | – | 403 |
| Read-only application can publish/delete fleetsAnalysed#1032468 | Valid | X / xAI | Access Control | Medium | 2021-01-04 | – | 398 |
| IDOR - Delete all Licenses and certifications from users account using CreateOrUpdateHackerCertification GraphQL queryAnalysed#2122671 | Valid | HackerOne | Insecure Direct Object Reference | High | 2023-08-29 | – | 395 |
| Remote Command Execution via Github importAnalysed#1679624 | Valid | GitLab | Command and Code Injection | Critical | 2022-10-06 | $33,510 | 392 |
| RCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag)Analysed#1609965 | Valid | GitLab | Command and Code Injection | Critical | 2022-09-13 | $33,510 | 387 |
| IDOR allows user to access report details via reference.json endpointAnalysed#3862641 | Valid | HackerOne | Insecure Direct Object Reference | Critical | 2026-10-01 | $15,000 | 372 |
| H1514 Ability to MiTM Shopify PoS Session to Takeover CommunicationsAnalysed#423467 | Valid | Shopify | Input Validation and Logic | Medium | 2019-11-04 | – | 372 |
| [CVE-2022-44268] Arbitrary Remote Leak via ImageMagickAnalysed#1858574 | Valid | HackerOne | File and Path Handling | Critical | 2023-03-16 | – | 371 |
| JSON serialization of any Project model results in all Runner tokens being exposed through Quick ActionsAnalysed#509924 | Valid | GitLab | Information Disclosure | Critical | 2019-04-20 | $12,000 | 366 |
| Bypass of GitLab CI runner slash fix in YAML validationAnalysed#409395 | Valid | GitLab | Input Validation and Logic | Critical | 2019-04-10 | – | 363 |
| URL link spoofingAnalysed#481472 | Valid | Slack | Input Validation and Logic | Low | 2020-04-26 | $250 | 362 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,614 analysed so far), which can be wrong. Data as of 2026-11-15.