Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Program	Weakness	Severity	Disclosed	Bounty	Votes
Discrepancy in hacker profile report count may reveal existence of a private program by publishing a reportAnalysed#410015	Valid	HackerOne	Information Disclosure	Medium	2019-04-24	$3,000	147
Reading redacted data via hackbot's answersAnalysed#247628	Valid	HackerOne	Information Disclosure	Medium	2017-07-27	$1,500	93
inviting collaborator using email disclose the hackerone account related to the userAnalysed#2045722	Valid	HackerOne	Information Disclosure	Medium	2024-09-19	–	80
No-Rate limit of current password on delete account endpoint(https://www.xvideos.com/account/close)Analysed#1392287	Valid	XVIDEOS	No weakness recorded	Low	2021-11-23	$100	67
Broken Access Control Exposes Email Verification Status and Privacy Settings via API EndpointAnalysed#3114132	Valid	WakaTime	Access Control	Low	2025-04-29	–	57
Graphql introspection is enabled and leaks details about the schemaAnalysed#1132803	Valid	On	Misconfiguration and Insecure Design	Low	2021-05-09	–	56
PII of Users Disclosure using "/members/invite/" endpointAnalysed#787955	Valid	Lab45	Information Disclosure	High	2020-04-13	–	54
Email Enumeration via Password-Protected Share Identity VerificationAnalysed#3507273	Valid	Nextcloud	Information Disclosure	Low	2026-09-05	$100	35
Possibility to enumerate and bruteforce promotion codes in Uber iOS AppAnalysed#125707	Valid	Uber	Authentication	Medium	2018-11-20	$3,000	24
[h1-2102] Information disclosure - ShopifyPlus add user displays existing Shopify ID fullnameAnalysed#1083922	Valid	Shopify	Information Disclosure	Medium	2022-02-10	–	18
No rate limiting for confirmation email lead to email flooding and leads to enumeration of emails in publishers.basicattentiontoken.orgAnalysed#854793	Valid	Brave Software	Misconfiguration and Insecure Design	Low	2020-11-09	–	18

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.