Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is presentAnalysed#3000510	Valid	Information Disclosure	Critical	2025-04-01	–	625
Disclosing PolicyPageAssetGroup in Private Programs via /graphql `gid://hackerone/PolicyPageAssetGroupsIndex::PolicyPageAssetGroup/{id}`Analysed#1618347	Valid	No weakness recorded	Critical	2025-01-21	$25,000	295
Account takeover of existing HackerOne accounts through SCIM provisioningAnalysed#3178999	Valid	Access Control	High	2025-07-17	–	232
Internal Access to Hackerone confluence DocsAnalysed#3113398	Valid	Misconfiguration and Insecure Design	High	2025-08-15	$12,500	227
Public GitHub repositories for multiple HackerOne managed triage team profiles contain private HackerOne reports informationAnalysed#2937622	Valid	Information Disclosure	Medium	2025-05-31	–	226
IDOR Vulnerability at AddTagToAssets operation nameAnalysed#2633771	Valid	Insecure Direct Object Reference	Medium	2025-06-08	–	178
Banned user still has access to their deleted account via HackerOne's API using their API keyAnalysed#1577940	Valid	Access Control	Medium	2025-07-14	–	150
Ability to access policy and updates for unauthorized programAnalysed#2965723	Valid	Access Control	Medium	2025-05-08	–	124
Domain highlighting on External link warning is not working on Chrome & Microsoft Edge browsers on MobileAnalysed#2553026	Valid	Misconfiguration and Insecure Design	Low	2025-03-13	–	82

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.