Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Git flag injection - local file overwrite to remote code executionAnalysed#658013 | Valid | Command and Code Injection | – | 2019-12-19 | $12,000 | 777 |
| Local files could be overwritten in GitLab, leading to remote command executionAnalysed#587854 | Valid | Command and Code Injection | – | 2019-07-17 | $12,000 | 542 |
| Remote Command Execution via Github importAnalysed#1679624 | Valid | Command and Code Injection | – | 2022-10-06 | $33,510 | 392 |
| RCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag)Analysed#1609965 | Valid | Command and Code Injection | – | 2022-09-13 | $33,510 | 387 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.