Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Availability Impact from Exploiting Project Name Vulnerabilities#2801036	Valid	Input Validation and Logic	Low	2024-11-13	$250	71
Acquisition on broken link listed on the page "https://docs.doppler.com/docs/removal-deprecated-packages-scripts in [scheduling a call]#2418210	Valid	Server-Side Request Forgery	Low	2024-05-22	–	49
Stored XSS in [https://dashboard.doppler.com/workplace/*/logs] pages#1073726	No longer public	Cross-site Scripting	–	–	–	42
WAF bypass and java script incomplete handling of Unicode characters might leads to dom-xss#2921905	Informative	Access Control	–	2025-01-13	–	36
Github app(link) Takeover Listed on "https://docs.doppler.com/docs/github-actions" page#2399386	Valid	No weakness recorded	–	2024-03-15	–	32
No rate limit into email change leads to email notification boombing to its victim.#1071660	No longer public	Access Control	–	–	–	8
email spoofing on doppler.team#1071521	No longer public	Misconfiguration and Insecure Design	–	–	–	7
Owner can change themself for another Role Mode but application doesnot have this function.#1072635	No longer public	Access Control	–	–	–	6
Bypass Email Verification.#1074196	No longer public	Access Control	–	–	–	3
User Access Control in Community Plan#1073734	No longer public	Access Control	–	–	–	3
Access page must be reloaded to perform multiple requests#1072210	No longer public	Input Validation and Logic	–	–	–	2
Limited access to billing dashboard by Admin and Collaborator in conflict with user role permissions.#1075540	No longer public	Information Disclosure	–	–	–	–

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.