Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| XSS in Desktop Client in the notificationsAnalysed#1668028 | Valid | Cross-site Scripting | Low | 2022-11-25 | $750 | 50 |
| Mail stored HTML injection in subject textAnalysed#3357036 | Valid | No weakness recorded | Medium | 2026-02-12 | – | 48 |
| position: fixed !important bypasses CSS sanitizer's fixed-position mitigation, enabling full-viewport phishing overlays.Analysed#3590586 | Valid | Injection and Smuggling | Medium | 2026-04-20 | – | 44 |
| Unquoted body background attribute enables CSS injection that bypasses remote image blockingAnalysed#3590583 | Valid | Injection and Smuggling | Medium | 2026-04-20 | – | 35 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,942 analysed so far), which can be wrong. Data as of 2026-11-15.