Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Subdomain Takeover on demo.greenhouse.io pointing to unbouncepages#407355	Valid	Input Validation and Logic	–	2020-03-05	–	76
Open S3 Bucket Accessible by any Aws User#819278	Valid	Access Control	–	2020-05-01	$100	53
Debug information disclosure on oauth-redirector.services.greenhouse.io#315205	Valid	Information Disclosure	–	2020-02-29	–	34
Subdomain Takeover using blog.greenhouse.io pointing to Hubspot#38007	Valid	Cross-site Scripting	–	2015-02-26	–	34
Cache poisoning using NULL bytes and long URLs#334709	Valid	Memory Corruption	–	2018-09-16	–	32
Bypass of request line length limit to DoS via cache poisoning#350847	Valid	Denial of Service	–	2018-09-16	–	24
DoS through cache poisoning using invalid HTTP parameters#326639	Valid	Denial of Service	–	2018-05-02	–	24
Open Redirect in <customer>.greenhouse.io#203726	Valid	Open Redirect	–	2017-07-08	–	9
SSH port on store.greenhouse.io is vulnerable to brute force attacks#897556	Informative	Authentication	–	2020-06-22	–	8
[greenhouse.io] CRLF Injection / Insecure nginx configuration#25275	Valid	No weakness recorded	–	2016-11-02	–	8
Content Spoofing on link.greenhouse.io#209521	Valid	Misconfiguration and Insecure Design	–	2017-07-27	–	6
SMTP protection not used (please read carefully )#25191	Informative	Authentication	–	2014-12-07	–	2
openssh-server Forced Command Handling Information Disclosure Vulnerability on blog.greenhouse.io#24984	Valid	Information Disclosure	–	2014-10-10	–	–

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.