Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Stored XSS via Kroki diagramAnalysed#1731349 | Valid | Cross-site Scripting | High | 2023-06-02 | $13,950 | 295 |
| Stored-XSS with CSP-bypass via labels' colorAnalysed#1665658 | Valid | Cross-site Scripting | High | 2023-02-19 | – | 169 |
| Account takeover due to insufficient URL validation on RelayState parameterAnalysed#1923672 | Valid | Cross-Site Request Forgery | Medium | 2023-05-30 | $2,450 | 99 |
| Bypass: Stored-XSS with CSP-bypass via scoped labels' color#1693150 | Valid | Cross-site Scripting | High | 2023-02-19 | – | 96 |
| Stored XSS in merge request pages#723307 | Valid | Cross-site Scripting | – | 2023-05-30 | $3,500 | 53 |
| Attacker is able to create,Edit & delete notes and leak the title of a victim's private personal snippet#1751258 | Valid | Insecure Direct Object Reference | Medium | 2023-06-02 | $1,730 | 29 |
| Domain Takeover - gl-canary.freetls.fastly.net#716677 | Valid | Access Control | – | 2023-05-30 | $200 | 25 |
| Attacker can create malicious child epics linked to a victim's epic in an unrelated group#1892200 | Valid | Insecure Direct Object Reference | Medium | 2023-06-02 | $1,160 | 22 |
| Blind SSRF in FogBugz project import#709951 | Duplicate | Server-Side Request Forgery | – | 2023-05-30 | – | 14 |
| Arbitrary escape sequence injection in docker-machine from worker nodes#1916285 | Informative | Command and Code Injection | Low | 2023-06-02 | – | 5 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (779 analysed so far), which can be wrong. Data as of 2026-11-14.