Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| DOM Based XSS in www.hackerone.com via PostMessageAnalysed#398054 | Valid | Cross-site Scripting | – | 2019-02-21 | $500 | 208 |
| Client-Side Race Condition using Marketo, allows sending user to data-protocol in Safari when form without onSuccess is submitted on www.hackerone.comAnalysed#381356 | Valid | Input Validation and Logic | – | 2019-04-05 | – | 154 |
| Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONPAnalysed#207042 | Valid | Misconfiguration and Insecure Design | – | 2017-08-29 | – | 153 |
| Content spoofing and potential Cross-Site Scripting vulnerability on www.hackerone.comAnalysed#374919 | Valid | Cross-site Scripting | – | 2018-08-04 | – | 129 |
| DOM Based XSS in www.hackerone.com via PostMessage (bypass of #398054)Analysed#499030 | Valid | Cross-site Scripting | – | 2019-05-04 | – | 106 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (779 analysed so far), which can be wrong. Data as of 2026-11-14.