Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
StatusAny
WeaknessAny class
- Any class
- Cross-site Scripting32
- Cross-Site Request Forgery8
- Open Redirect7
- Server-Side Request Forgery5
- Command and Code Injection9
- Injection and Smuggling2
- File and Path Handling2
- Denial of Service2
- Input Validation and Logic5
- Misconfiguration and Insecure Design13
- Cryptography3
- Information Disclosure11
- Authentication16
- Access Control10
- Other weaknesses1
- No weakness recorded7
Access (title)Any
Access (analysis)Any
TechniqueAny
133 of 15,219 reports · $49,875 in bounties · 161 analysed so far
- #737140ValidAnalysedMass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookiesSlack · Injection and Smuggling · 2020 · needs: no account · Request smuggling, Account takeover chain, Information disclosure–870votes
- #783877ValidAnalysedRemote Code Execution in Slack desktop apps + bonusSlack · Command and Code Injection · 2020 · needs: a user account · Code injection / eval, Open redirect, Stored XSS–509votes
- #146336ValidAnalysedXSS vulnerable parameter in a location hashSlack · Cross-site Scripting · 2019 · needs: no account · Reflected XSS–455votes
- #481472ValidAnalysedURL link spoofingSlack · Input Validation and Logic · 2020 · needs: a user account · Open redirect, Business logic flaw$250362votes
- #333419ValidAnalysedTURN server allows TCP and UDP proxying to internal network, localhost and meta-data servicesSlack · Server-Side Request Forgery · 2020 · needs: not clear from the report · SSRF, Information disclosure$3,500323votes
- #404822ValidAnalysedAWS bucket leading to iOS test build code and configuration exposureSlack · Information Disclosure · 2019 · needs: no account · Cloud storage misconfiguration, Information disclosure$1,500321votes
- #531032ValidSlack DTLS uses a private key that is in the public domain, which may lead to SRTP stream hijackSlack · Cryptography · 2020$2,000170votes
- #11073ValidXSS in gist integrationSlack · Cross-site Scripting · 2019$500157votes
- #272578ValidUnauthenticated LFI revealing log informationSlack · Information Disclosure · 2018 · no account (title)–123votes
- #207170ValidStealing xoxs-tokens using weak postMessage / call-popup redirect to current team domainSlack · Misconfiguration and Insecure Design · 2017–120votes
- #1716016ValidAbility to join an arbitrary workspace by utilizing a proxy to manipulate invite linksSlack · Authentication · 2023–109votes
- #1077136ValidDenial of Service via Hyperlinks in PostsSlack · Denial of Service · 2021$1,500109votes
- #671935ValidSSRF via Office file thumbnailsSlack · Information Disclosure · 2022$4,000109votes
- #816156ValidTeam members can trigger arbitrary code execution in Slack Desktop Apps via HTML NotificationsSlack · Command and Code Injection · 2021 · a user account (title)–107votes
- #132104ValidStored XSS on team.slack.com using new Markdown editor of posts inside the Editing mode and using javascript-URIsSlack · Cross-site Scripting · 2016–103votes
- #833080ValidTricking the "Create snippet" feature into displaying the wrong filetype can lead to RCE on Slack usersSlack · File and Path Handling · 2020$1,500101votes
- #1102764ValidLack of URL normalization renders Blocked-Previews feature ineffectualSlack · Other weaknesses · 2022$1,000100votes
- #503283ValidReal Time Error Logs Through Debug InformationSlack · Information Disclosure · 2019–100votes
- #727330ValidHeader modification results in disclosure of Slack infra metadata to unauthorized partiesSlack · Server-Side Request Forgery · 2021–97votes
- #470637ValidUser-assisted RCE in Slack for macOS (from official site) due to improper quarantine meta-attribute handling for downloaded filesSlack · No weakness recorded · 2019–97votes
- #239623ValidMany Slack teams can be joined by abusing an improperly configured support@ inboxSlack · Authentication · 2017–88votes
- #1663361ValidBypass invite accept for victimSlack · Input Validation and Logic · 2023–84votes
- #381129ValidSSRF in api.slack.com, using slash commands and bypassing the protections.Slack · Server-Side Request Forgery · 2019–84votes
- #1758174ValidUnauthorized access to GovSlackSlack · Authentication · 2023$1,50081votes
- #881557ValidStored XSS through PDF viewerSlack · Cross-site Scripting · 2022$4,87576votes
- #79348ValidOSX slack:// protocol handler javascript injectionSlack · Command and Code Injection · 2016–72votes
- #184698ValidEavesdropping on private Slack callsSlack · Authentication · 2017$1,00068votes
- #130133ValidAccess to some Slack workspace metadata and settings available to unauthorized partiesSlack · Authentication · 2020$7,00060votes
- #258198ValidThe Custom Emoji Page has a Reflected XSSSlack · Cross-site Scripting · 2017–56votes
- #386292ValidBypass of the SSRF protection in Event Subscriptions parameter.Slack · Server-Side Request Forgery · 2019–52votes
- #356765ValidInternal SSRF bypass using slash commands at api.slack.comSlack · Server-Side Request Forgery · 2018–51votes
- #1378889Valid[Android] Directory traversal leading to disclosure of auth tokensSlack · File and Path Handling · 2022$3,50050votes
- #834071ValidXSS on link and window.openerSlack · Cross-site Scripting · 2023$1,00049votes
- #415272ValidLinux Desktop application slack executable does not use pie / no ASLRSlack · Misconfiguration and Insecure Design · 2019$10047votes
- #375097ValidThe POODLE attack (SSLv3 supported) at status.slack.comSlack · Cryptography · 2018–44votes
- #187410ValidStore XSSSlack · Cross-site Scripting · 2017–44votes
- #305518ValidInformation leakage and default open portSlack · No weakness recorded · 2019–41votes
- #966814ValidSlack-Corp Heroku application disclosing limited info about company membersSlack · Information Disclosure · 2020–39votes
- #864489ValidWorkspace configuration metadata disclosureSlack · Information Disclosure · 2022–39votes
- #375083ValidPrivate application files can be uploaded to Slack via malicious uploaderSlack · Information Disclosure · 2021$50038votes
- #679969ValidCSS Injection to disable app & potential message exfilSlack · Input Validation and Logic · 2019–37votes
- #121696ValidBypass two-factor authenticationSlack · Authentication · 2017–36votes
- #500348ValidURL filter bypass in Enterprise GridSlack · Input Validation and Logic · 2020$10032votes
- #200427ValidAccess of Android protected components via embedded intentSlack · Access Control · 2017–31votes
- #163938ValidSnooping into messages via email serviceSlack · Authentication · 2016–30votes
- #746003ValidDoS on the Direct MessagesSlack · Denial of Service · 2020$50029votes
- #165570ValidRace Condition in account surveySlack · Misconfiguration and Insecure Design · 2017–29votes
- #159460ValidStored XSS(Cross Site Scripting) In Slack App NameSlack · Cross-site Scripting · 2016$1,00029votes
- #1461194ValidEmail html InjectionSlack · Command and Code Injection · 2022$25028votes
- #195350ValidSubdomain takeover on podcasts.slack-core.comSlack · Cross-site Scripting · 2017$10027votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.