Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Stored XSS via Kroki diagramAnalysed#1731349 | Valid | Cross-site Scripting | High | 2023-06-02 | $13,950 | 295 |
| Stored-XSS with CSP-bypass via labels' colorAnalysed#1665658 | Valid | Cross-site Scripting | High | 2023-02-19 | – | 169 |
| Account takeover due to insufficient URL validation on RelayState parameterAnalysed#1923672 | Valid | Cross-Site Request Forgery | Medium | 2023-05-30 | $2,450 | 99 |
| Bypass: Stored-XSS with CSP-bypass via scoped labels' colorAnalysed#1693150 | Valid | Cross-site Scripting | High | 2023-02-19 | – | 96 |
| Stored XSS in merge request pagesAnalysed#723307 | Valid | Cross-site Scripting | High | 2023-05-30 | $3,500 | 53 |
| Attacker is able to create,Edit & delete notes and leak the title of a victim's private personal snippetAnalysed#1751258 | Valid | Insecure Direct Object Reference | Medium | 2023-06-02 | $1,730 | 29 |
| Domain Takeover - gl-canary.freetls.fastly.netAnalysed#716677 | Valid | Access Control | Low | 2023-05-30 | $200 | 25 |
| Attacker can create malicious child epics linked to a victim's epic in an unrelated groupAnalysed#1892200 | Valid | Insecure Direct Object Reference | Medium | 2023-06-02 | $1,160 | 22 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.