Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
12 of 15,219 reports · $200 in bounties · 227 analysed so far
- #98247Validlogin to any user's cashier account and full account information disclosureDeriv.com · Authentication · 2015–27votes
- #297198ValidLeaking Referrer in Reset Password LinkDeriv.com · Misconfiguration and Insecure Design · 2018$5014votes
- #95981ValidHttp Response Splitting - Validate linkDeriv.com · No weakness recorded · 2015$7511votes
- #98469ValidEmail Verification Link can be Used as Password Reset Link!Deriv.com · Authentication · 2015–7votes
- #140392ValidCJ vulnerability in subdomainDeriv.com · Misconfiguration and Insecure Design · 2016–5votes
- #97609InformativeUser Enumeration : Due to rate limiting on registrationDeriv.com · Information Disclosure · 2015–5votes
- #95599ValidCross Site ScriptingDeriv.com · Cross-site Scripting · 2015–5votes
- #158757ValidCross site scriptingDeriv.com · Cross-site Scripting · 2016$754votes
- #112306ValidFull takeover of some binary.com sub domainsDeriv.com · No weakness recorded · 2016–4votes
- #101983ValidCookie bugDeriv.com · Authentication · 2015–4votes
- #109832DuplicateHTML injection via 'underlying' parameterDeriv.com · Cross-site Scripting · 2016–3votes
- #111131DuplicateXSSDeriv.com · Cross-site Scripting · 2016–2votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.