Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Github Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL apiAnalysed#1711938	Valid	Access Control	–	2023-01-26	–	198
Authentication bypass on gist.github.com through SSH CertificatesAnalysed#1901040	Valid	Access Control	High	2023-04-20	$10,000	182
Github app Privilege Escalation to Administrator/Owner of the Organization#1732595	Valid	Access Control	High	2023-01-13	–	98
Rogue collaborators and ambiguous branch names in GitHub#1831528	Valid	Input Validation and Logic	–	2023-12-05	–	43
Smuggling content in PR with refs/replace in GitHub#1938106	Valid	Injection and Smuggling	Medium	2023-08-01	–	35
Git Reference Ambiguity in GitHub - Commit Smuggling, Account Takeover, and Remote Code Execution#2017600	Valid	Injection and Smuggling	Medium	2023-11-29	–	25
Improper handling of null bytes in GitHub Actions Runner allows an attacker to set arbitrary environment variables#1762025	Valid	Injection and Smuggling	Medium	2023-03-09	–	19

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.