Disclosed bug bounty reports

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Open redirect vulnerability#2731	Informative	Open Redirect	–	2014-04-06	–	11
Slack OAuth2 "redirect_uri" Bypass#2575	Valid	Authentication	–	2014-05-29	–	10
Stored XSS Found#9774	Valid	Cross-site Scripting	–	2014-06-01	–	9
Data exports stored on S3 can be scraped easily#2746	Valid	Authentication	–	2014-12-09	–	9
Open Redirect login account#16718	Valid	Open Redirect	–	2014-08-25	$100	8
Stored XSS in Slackbot Direct Messages#4561	Valid	Cross-site Scripting	–	2014-05-04	–	8
Email enumeration#2766	Informative	Information Disclosure	–	2014-04-02	–	8
Stored XSS in www.slack-files.com#2617	Valid	Cross-site Scripting	–	2014-05-23	–	8
Broken Authentication (including Slack OAuth bugs)#2559	Valid	Misconfiguration and Insecure Design	–	2014-08-30	–	8
Remote file Inclusion - RFI in upload#14092	Informative	Command and Code Injection	–	2014-07-08	–	7
Session Fixation disclosing email address#2582	Informative	Information Disclosure	–	2014-03-31	–	7
State parameter missing on google OAuth#2688	Valid	Cross-Site Request Forgery	–	2014-04-06	–	6
Stored XSS on this link https://sehacure.slack.com/help/requests/#2639	Valid	Cross-site Scripting	–	2014-08-30	–	6
Password Policy issue (Weak Protect)#17160	Valid	Misconfiguration and Insecure Design	–	2014-09-04	–	5
SSRF on https://whitehataudit.slack.com/account/photo#14127	Valid	Command and Code Injection	–	2014-12-21	–	5
CSRF vulnerability on https://sehacure.slack.com/account/settings#2628	Valid	Cross-Site Request Forgery	–	2014-07-26	–	5
URL redirection flaw#2622	Valid	Open Redirect	–	2014-08-30	–	5
Content Spoofing all Integrations in https://team.slack.com/services/new/#22093	Valid	Misconfiguration and Insecure Design	–	2014-09-03	$200	4
Stored XSS#2926	Valid	Cross-site Scripting	–	2014-04-06	–	4
Reflected Xss#2777	Valid	Cross-site Scripting	–	2014-05-19	$500	4
csrf#2635	Valid	Cross-Site Request Forgery	–	2014-04-06	–	4
Stored XSS in username.slack.com#2625	Valid	Cross-site Scripting	–	2014-08-07	–	4
Duplicate of #4550#4638	Valid	No weakness recorded	–	2014-05-21	–	3
User impersonation is possible with incoming webhooks#3722	Informative	Misconfiguration and Insecure Design	–	2014-04-10	–	3
Content Spoofing#2979	Informative	Misconfiguration and Insecure Design	–	2014-08-11	–	3
Stored XSS in Channel Chat#2652	Valid	Cross-site Scripting	–	2014-05-21	–	3
CSRF on add comment section#2638	Valid	Cross-Site Request Forgery	–	2014-04-12	–	3
HTTP Strict Transport Policy not enabled on newly made accounts#26763	Valid	Misconfiguration and Insecure Design	–	2014-10-03	–	2
Content spoofing at Stripe Integrations#21248	Valid	Misconfiguration and Insecure Design	–	2014-08-25	$100	2
Stored XSS in slack.com (integrations)#10297	Valid	Cross-site Scripting	–	2014-05-29	–	2
open redirect in https://slack.com#6035	Informative	Open Redirect	–	2014-05-31	–	2
TLS1/SSLv3 Renegotiation Vulnerability#5617	Informative	No weakness recorded	–	2014-08-14	–	2
Open Redirect in Slack#4549	Informative	Open Redirect	–	2014-05-21	–	2
flash content type sniff vulnerability in api.slack.com#3455	Valid	Cross-Site Request Forgery	–	2014-04-08	–	2
Deleting Teams implemenation#2975	Informative	Authentication	–	2014-08-21	–	2

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.