Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
StatusAny
WeaknessAny class
- Any class
- Cross-site Scripting22
- Cross-Site Request Forgery3
- Open Redirect2
- Command and Code Injection8
- Injection and Smuggling1
- Deserialization and Object Injection1
- File and Path Handling5
- Denial of Service7
- Input Validation and Logic2
- Misconfiguration and Insecure Design2
- Cryptography1
- Information Disclosure4
- Authentication1
- Access Control1
- No weakness recorded13
73 of 15,219 reports · $9,000 in bounties · 227 analysed so far
- #519220ValidFile writing by Directory traversal at actionpack-page_caching and RCE by itRuby on Rails · File and Path Handling · 2020$1,00080votes
- #3008446Informative1-Click Cross-Site Scripting via Custom Configuration in SafeListSanitizerRuby on Rails · Cross-site Scripting · 2025 · Medium–70votes
- #3580511ValidActiveStorage Disk Service Path Traversal via Custom Blob Key InjectionRuby on Rails · File and Path Handling · 2026 · Medium–57votes
- #2303609ValidXSS when using `translate` in Action Controller (Rails 7.0, 7.1)Ruby on Rails · Cross-site Scripting · 2024 · Low–50votes
- #895727ValidRack parses encoded cookie names allowing an attacker to send malicious `__Host-` and `__Secure-` prefixed cookiesRuby on Rails · Input Validation and Logic · 2020–46votes
- #1444151ValidXSS vulnerabilities due to missing checks in tag helpersRuby on Rails · Cross-site Scripting · 2023–41votes
- #473888ValidRCE which may occur due to `ActiveSupport::MessageVerifier` or `ActiveSupport::MessageEncryptor` (especially Active storage)Ruby on Rails · Command and Code Injection · 2019$1,50041votes
- #307808ValidPath Traversal on Default Installed Rails Application (Asset Pipeline)Ruby on Rails · File and Path Handling · 2018$1,50038votes
- #2334455InformativePath traversal in AcitveStorage, and lead RCERuby on Rails · File and Path Handling · 2024 · High–37votes
- #2389565ValidAction Text XSS (Rails 7.1.x)Ruby on Rails · Cross-site Scripting · 2025 · Medium–33votes
- #1023899ValidRegular expression denial of service in ActiveRecord's PostgreSQL Money typeRuby on Rails · Denial of Service · 2021–33votes
- #3553340InformativeActive Storage Vips Transformer Missing validate_transformation — CVE-2025-24293 Incomplete FixRuby on Rails · File and Path Handling · 2026 · High–30votes
- #2389431ValidAction Text ReDoS (Ruby 3.1 or lower)Ruby on Rails · Denial of Service · 2026 · Low–28votes
- #1154034ValidArgument/Code Injection via ActiveStorage's image transformation functionalityRuby on Rails · Command and Code Injection · 2023–27votes
- #2307813ValidDoS with crafted "Range" headerRuby on Rails · No weakness recorded · 2024 · High–24votes
- #1694173ValidActionView sanitize helper bypass leading to XSS using SVG tag.Ruby on Rails · Cross-site Scripting · 2023–24votes
- #3994016ValidAction Text to_markdown: <code>/<pre> content escapes its delimiter, letting a stored body inject arbitrary MarkdownRuby on Rails · Cross-site Scripting · 2026 · Medium–23votes
- #3601655ValidRails::HTML::Sanitizer.allowed_uri? returns true for entity-encoded control-character-split javascript: URLsRuby on Rails · No weakness recorded · 2026 · Low–23votes
- #1302395DuplicateSauce Labs API key unencrypted in an old commitRuby on Rails · Cryptography · 2024 · Medium–23votes
- #394253ValidValidation bypass for queries generated for PostgreSQLRuby on Rails · No weakness recorded · 2018$1,50021votes
- #1327196ValidContent Security Policy is only active for HTML responses but not for image/svg+xmlRuby on Rails · Cross-site Scripting · 2023–20votes
- #904059ValidOpen Redirect (6.0.0 < rails < 6.0.3.2)Ruby on Rails · Open Redirect · 2020$1,00019votes
- #2814774ValidPossible DoS in NumberHelpersRuby on Rails · Denial of Service · 2026 · Medium–18votes
- #1489141ValidReDoS in Rack::MultipartRuby on Rails · No weakness recorded · 2023–18votes
- #328270ValidXSS vulnerability in sanitize-method when parsing link's hrefRuby on Rails · Cross-site Scripting · 2018–18votes
- #1429148ValidSubdomain Takeover at https://new.rubyonrails.org/Ruby on Rails · Access Control · 2022–17votes
- #431561ValidSpecially constructed multi-part requests cause multi-second response times; vulnerable to DoSRuby on Rails · No weakness recorded · 2018–17votes
- #4082665InformativeActionText `to_markdown` still allows `javascript:` links in kramdown via Rails-generated table cells after PR #58754Ruby on Rails · Cross-site Scripting · 2026 · Medium–15votes
- #1955370ValidIncorrect handling of certain characters passed to the redirection functionality in Rails can lead to a single-click XSS vulnerability.Ruby on Rails · Cross-site Scripting · 2023–15votes
- #3727743ValidURI scheme validation bypass in ActionText `to_markdown` via user-supplied `<action-text-markdown>` marker tagRuby on Rails · Cross-site Scripting · 2026 · Medium–13votes
- #803922ValidMissing resource identifier encoding may lead to security vulnerabilitiesRuby on Rails · Information Disclosure · 2020–13votes
- #474262ValidXSS due to incomplete JS escapingRuby on Rails · Cross-site Scripting · 2020–13votes
- #44513ValidRCE due to Web Console IP Whitelist bypass in Rails 4.0 and 4.1Ruby on Rails · Command and Code Injection · 2015–13votes
- #1684163ValidReDoS (Rails::Html::PermitScrubber.scrub_attribute)Ruby on Rails · No weakness recorded · 2023–11votes
- #1106652Validredirect_to(["string"]) remote code executionRuby on Rails · Information Disclosure · 2021–9votes
- #90457ValidNested attributes reject_if proc can be circumvented by providing "_destroy" parameterRuby on Rails · No weakness recorded · 2016–9votes
- #46019ValidExplicit, dynamic render path: Dir. Trav + RCERuby on Rails · Command and Code Injection · 2016$5009votes
- #1656627ValidRails::Html::SafeListSanitizer vulnerable to XSS when certain tags are allowed (math+style || svg+style)Ruby on Rails · Cross-site Scripting · 2022–8votes
- #1530898ValidRails::Html::SafeListSanitizer vulnerable to xss attack in an environment that allows the style tagRuby on Rails · Cross-site Scripting · 2022–8votes
- #407319ValidActiveStorage service's signed URLs can be hijacked via AppCache+Cookie stuffing trick when using GCS or DiskServiceRuby on Rails · Information Disclosure · 2018–8votes
- #47280ValidJSON keys are not properly escapedRuby on Rails · Cross-site Scripting · 2015–8votes
- #42797ValidDenial of Service in Action Pack Exception HandlingRuby on Rails · Denial of Service · 2015–8votes
- #3370ValidDirectory traversal attack in view resolverRuby on Rails · Information Disclosure · 2015–8votes
- #1654310ValidIncomplete fix for CVE-2022-32209 (XSS in Rails::Html::Sanitizer under certain configurations)Ruby on Rails · Cross-site Scripting · 2022–7votes
- #1047447ValidHostAuthorization middleware does not suitably sanitize the Host / X-Forwarded-For header allowing redirection.Ruby on Rails · Open Redirect · 2021–7votes
- #732415ValidThe authenticity_token can be reversed and used to forge valid per_form_csrf_tokens for arbitrary routesRuby on Rails · Cross-Site Request Forgery · 2020–7votes
- #139321ValidUnsafe Query Generation (CVE-2012-2660, CVE-2012-2694 and CVE-2013-0155) mitigation bypassRuby on Rails · No weakness recorded · 2018–7votes
- #113928ValidRemote code execution using render :inlineRuby on Rails · Command and Code Injection · 2016$1,5007votes
- #94568Validhttp_basic_authenticate_with is suseptible to timing attacks.Ruby on Rails · Authentication · 2016–7votes
- #888176InformativeHTTP Host injection in redirect_to functionRuby on Rails · Injection and Smuggling · 2021–6votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.