Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Second-Order XSS via javascript protocol in MCP Server Portal Apps leads to ATOAnalysed#3316910 | Valid | Cross-site Scripting | Low | 2025-12-16 | – | 50 |
| Sign in with Apple works on existing accounts, bypasses 2FAAnalysed#1593404 | Valid | Authentication | High | 2022-06-27 | $1,000 | 32 |
| Sign in with Apple generates long-life JWTs, seemingly irrevocable, that grant immediate access to accountsAnalysed#1593413 | Valid | Authentication | Low | 2022-06-27 | $250 | 17 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.