Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| CSRF Trial 14 days express subscriptionAnalysed#334139 | Valid | Cross-Site Request Forgery | – | 2019-02-27 | – | 59 |
| Race Condition in Redeeming CouponsAnalysed#157996 | Valid | Misconfiguration and Insecure Design | – | 2016-09-12 | – | 43 |
| Authorization Bypass in Delivery Chat LogsAnalysed#144000 | Valid | Access Control | – | 2016-11-03 | $100 | 35 |
| Cross-Site Request Forgery (CSRF)Analysed#157993 | Valid | Cross-Site Request Forgery | – | 2016-10-13 | – | 33 |
| Server side request forgery on image upload for listsAnalysed#158016 | Valid | Command and Code Injection | – | 2016-10-12 | $50 | 21 |
| View & add to cart unlisted items via IDOR#344284 | Valid | Insecure Direct Object Reference | High | 2018-05-25 | – | 19 |
| Reverse Tab-nabbing at www.instacart.com/store/partner_recipe?recipe_url=#227833 | Valid | No weakness recorded | – | 2017-05-30 | – | 19 |
| Cross-Site Scripting Reflected On Main Domain#104917 | Valid | Cross-site Scripting | – | 2016-09-30 | – | 19 |
| XSS at in instacart.com/store/partner_recipe#227809 | Valid | Cross-site Scripting | Low | 2017-05-30 | – | 18 |
| Host Header Injection/Redirection in: https://www.instacart.com/#158019 | Valid | Open Redirect | – | 2016-09-11 | – | 17 |
| Stored XSS#157958 | Valid | Cross-site Scripting | – | 2016-09-09 | – | 17 |
| Get all instacart emails - missing rate limit on /accounts/register#275186 | Valid | No weakness recorded | Medium | 2017-12-01 | $150 | 16 |
| Cookie-Based Injection#105419 | Valid | Cross-site Scripting | – | 2016-09-26 | – | 16 |
| Login with Google Not Authenticated on iOS App#202177 | Valid | Authentication | Low | 2017-05-21 | – | 15 |
| XSS in instacart.com/store/partner_recipe#196221 | Valid | Cross-site Scripting | Medium | 2017-05-11 | $100 | 15 |
| Bruteforcing password reset tokens, could lead to account takeover#271533 | Valid | Authentication | Medium | 2017-11-06 | $50 | 14 |
| Hyperlink Injection in Friend Invitation Emails#158554 | Valid | Open Redirect | – | 2016-09-12 | $100 | 14 |
| Full access to any list#173969 | Valid | Access Control | – | 2016-11-18 | $150 | 13 |
| Brute force login and bypass locked account restrictions via iOS app#160109 | Valid | Misconfiguration and Insecure Design | – | 2016-09-19 | – | 11 |
| Issues with uploading list images#159820 | Valid | Denial of Service | – | 2016-09-26 | – | 11 |
| shopper login_code's can be brute forced#158157 | Valid | Authentication | – | 2016-09-17 | – | 9 |
| WordPress Authentication Denial of Service#163307 | Valid | Denial of Service | – | 2017-05-26 | $100 | 8 |
| CSRF To change Email Notification Settings#157956 | Valid | Cross-Site Request Forgery | – | 2016-09-15 | – | 8 |
| READ .svg files by changing .svg into .png extension#161301 | Valid | Misconfiguration and Insecure Design | – | 2017-03-29 | – | 7 |
| Access private list metadata#178506 | Valid | Information Disclosure | Low | 2016-12-24 | $100 | 6 |
| Fetch private list metadata and any user's personal name#162822 | Valid | Information Disclosure | – | 2016-09-12 | $150 | 6 |
| Seemingly sensitive information at /api/v2/zones#165131 | Valid | Information Disclosure | – | 2016-11-16 | $50 | 5 |
| Image Upload Path Disclosure#158021 | Valid | Information Disclosure | – | 2016-09-12 | $100 | 5 |
| Missing rel=noreferrer tag allows link in list to change url of currently open tab#158002 | Valid | Misconfiguration and Insecure Design | – | 2016-09-12 | – | 4 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.