Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Open redirect#214034 | Valid | Open Redirect | – | 2017-04-06 | – | 4 |
| Email notification about login email changed is not received when using verified linked email address#801973 | N/A | Misconfiguration and Insecure Design | – | 2020-03-25 | – | 3 |
| SSRF via git Repo by URL Abuse#191216 | Duplicate | Server-Side Request Forgery | – | 2017-11-28 | – | 3 |
| No Restriction on password#1696814 | N/A | No weakness recorded | – | 2022-09-13 | – | 2 |
| Use of Ruby Forwardable module and runtime meta-programming may introduce vulnerabilities#874401 | Informative | Information Disclosure | – | 2021-11-15 | – | 2 |
| Lack of validation before assigning custom domain names leading to abuse of GitLab pages service#296907 | Informative | Input Validation and Logic | – | 2018-02-01 | – | 2 |
| Missing/Breach of Internal Security Boundary - Access to Job Queue Results in Remote Code Execution#224198 | Informative | Misconfiguration and Insecure Design | – | 2017-06-28 | – | – |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.