Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Exfiltrate and mutate repository and project data through injected templated serviceAnalysed#446585 | Valid | Access Control | – | 2019-03-05 | $11,000 | 762 |
| SSRF on project import via the remote_attachment_url on a NoteAnalysed#826361 | Valid | Server-Side Request Forgery | – | 2020-06-07 | $10,000 | 359 |
| Server Side Request Forgery mitigation bypassAnalysed#632101 | Valid | Server-Side Request Forgery | – | 2020-04-18 | – | 350 |
| Unauthenticated blind SSRF in OAuth Jira authorization controllerAnalysed#398799 | Valid | Server-Side Request Forgery | – | 2019-03-14 | $4,000 | 238 |
| Arbitrary file read during project importAnalysed#1132378 | Valid | File and Path Handling | – | 2021-05-24 | $16,000 | 194 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.