Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
11 of 15,219 reports · $4,000 in bounties · 227 analysed so far
- #3560256ValidCross-repository IDOR in `/settings/security_analysis/bypass_reviewers` allows unauthorized delegated bypass reviewer modificationGitHub · Insecure Direct Object Reference · 2026 · Medium–108votes
- #3713965ValidAble to bypass authorization logic and gain more access then intendedGitHub · No weakness recorded · 2026 · Medium–105votes
- #2501036ValidAccess body and title of Internal Repo Issues in ProjectsGitHub · Information Disclosure · 2024 · Medium–100votes
- #2484635ValidGitHub Apps can access suspended installations via scoped user-to-server tokensGitHub · Access Control · 2024 · Medium–90votes
- #2505761ValidInformation Leakage via Clicked Link in GitHub Repository (Fingerprinting)GitHub · Information Disclosure · 2024 · Medium$4,00072votes
- #3527771ValidAdd labels to arbitrary issues/prs & compromise github actions label checksGitHub · Insecure Direct Object Reference · 2026 · Medium–71votes
- #2469713ValidView private repository NWO of deploy key via internal LFS APIGitHub · Access Control · 2024 · Medium–70votes
- #3641229ValidGitHub user to server tokens can create issues in any public repositoryGitHub · Access Control · 2026 · Medium–62votes
- #3522254ValidPATs without the required scope can leak issuesGitHub · Access Control · 2026 · Medium–59votes
- #2357443ValidRC Between GitHub's Repo Update REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access RetentionGitHub · Misconfiguration and Insecure Design · 2024 · Medium–50votes
- #3527788ValidAdd labels to arbitrary issues/prs via Memex Bulk Update to compromise github actions label gatingGitHub · Insecure Direct Object Reference · 2026 · Medium–46votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.