Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Stored XSS via Kroki diagramAnalysed#1731349 | Valid | Cross-site Scripting | High | 2023-06-02 | $13,950 | 295 |
| Cross-site Scripting (XSS) - Stored in RDoc wiki pagesAnalysed#662287 | Valid | Misconfiguration and Insecure Design | – | 2019-12-16 | $3,500 | 282 |
| Stored XSS in Notes (with CSP bypass for gitlab.com)Analysed#1481207 | Valid | Cross-site Scripting | – | 2022-05-25 | – | 161 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.