Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
StatusAny
WeaknessAny class
- Any class
- Cross-site Scripting7
- Cross-Site Request Forgery4
- Open Redirect1
- Server-Side Request Forgery11
- SQL Injection1
- Injection and Smuggling1
- File and Path Handling1
- Memory Corruption1
- Race Conditions1
- Denial of Service1
- Input Validation and Logic9
- Misconfiguration and Insecure Design6
- Cryptography6
- Information Disclosure1
- Authentication2
- Access Control12
- No weakness recorded7
72 of 15,219 reports · 161 analysed so far
- #783360ValidOpen memory dump method leaking customer information ,secret keys , password , source code & admin accountsStripo Inc · Access Control · 2020–158votes
- #983331ValidPublic and secret api key leaked in JavaScript sourceStripo Inc · Cryptography · 2020–148votes
- #3459285Valid[Critical] Unauthorized Cross-Tenant Data Access in Stripo AI Hub Campaign via Deleted Project.Stripo Inc · Access Control · 2026 · Critical–140votes
- #2932960Valid[my.stripo.email] Blind SSRF Vulnerability in Stripo App Export via Missing Endpoints Export Email Message to ZapierStripo Inc · Server-Side Request Forgery · 2025 · Critical–92votes
- #714521Validstripo.email reflected xssStripo Inc · Cross-site Scripting · 2019–70votes
- #738569ValidNo length on passwordStripo Inc · No weakness recorded · 2019–64votes
- #738899ValidAble to change password by entering wrong old passwordStripo Inc · Cryptography · 2019–56votes
- #1029723ValidNo rate limiting for subscribe email + lead to Cross origin misconfigurationStripo Inc · Input Validation and Logic · 2020–54votes
- #1009046ValidAble to use 'PREMIUM TEMPLATES' in 'FREE PLAN' at [https://my.stripo.email/cabinet/#/my-templates/]Stripo Inc · Input Validation and Logic · 2021–51votes
- #856305Valid[www.stripo.email] There is no rate limit for contact-us endpointsStripo Inc · Access Control · 2020–47votes
- #1166766ValidBypassing Content-Security-Policy leads to open-redirect and iframe xssStripo Inc · Open Redirect · 2021–36votes
- #737695Validsubdomain takeover at status0.stripo.emailStripo Inc · Access Control · 2019–36votes
- #855013Valid[www.stripo.email] You can override the speed limit by adding the X-Forwarded-For header.Stripo Inc · Access Control · 2020–34votes
- #753375ValidUpload Profile Photo in any folder you want with any extension you wantStripo Inc · Access Control · 2022–33votes
- #1622432Valid[SSRF] my.stripo.email via the setup-wizard parameterStripo Inc · Server-Side Request Forgery · 2024–29votes
- #1019367ValidMemory Dump and Env Disclosure via Spring Boot ActuatorStripo Inc · Misconfiguration and Insecure Design · 2021–27votes
- #1065964ValidStored XSS in the banner block descriptionStripo Inc · Cross-site Scripting · 2021–25votes
- #771382ValidSSRF & unrestricted file upload on https://my.stripo.email/Stripo Inc · Server-Side Request Forgery · 2020–24votes
- #1126433ValidStored XSS at Module NameStripo Inc · Cross-site Scripting · 2021–23votes
- #985367Validweak password poilicy in signup password leak to account takeoverStripo Inc · Misconfiguration and Insecure Design · 2020–23votes
- #1023920ValidSSRF external interactionStripo Inc · Server-Side Request Forgery · 2020–21votes
- #751299ValidImproper AuthorizationStripo Inc · Access Control · 2020–20votes
- #737042ValidPassword token leak via Host headerStripo Inc · Misconfiguration and Insecure Design · 2019–20votes
- #1076047ValidBypass of #1047119: Missing Rate Limit while creating Plug-Ins at https://my.stripo.email/cabinet/plugins/Stripo Inc · Input Validation and Logic · 2021–19votes
- #1047125ValidNon-revoked API Key Disclosure in a Disclosed API Key Disclosure Report on StripoStripo Inc · Cryptography · 2020–19votes
- #1631228Valid[demo.stripo.email] HTTP request SmugglingStripo Inc · Injection and Smuggling · 2024–18votes
- #1047100ValidNo rate limiting - Create dataStripo Inc · Input Validation and Logic · 2021–18votes
- #737169ValidBypass email verification and create email template with the editorStripo Inc · No weakness recorded · 2019–18votes
- #1047124ValidNo rate limit in email subscriptionStripo Inc · Input Validation and Logic · 2021–16votes
- #781614Validsubdomain takeover at status-stage0.stripo.emailStripo Inc · Access Control · 2020–16votes
- #1166993ValidAbility to use premium templates as free user via https://stripo.email/templates/?utm_source=viewstripo&utm_medium=referralStripo Inc · Input Validation and Logic · 2022–15votes
- #777651ValidHTTP Request Smuggling on my.stripo.emailStripo Inc · No weakness recorded · 2020–15votes
- #766205Validcsrf bypass using flash file + 307 redirect method at plugins endpointStripo Inc · Cross-Site Request Forgery · 2020–15votes
- #737039ValidOLD SESSION DOES NOT EXPIRE AFTER PASSWORD CHANGEStripo Inc · No weakness recorded · 2019–15votes
- #764122ValidNo Rate Limiting on /reset-password-request/ endpointStripo Inc · Misconfiguration and Insecure Design · 2020–14votes
- #1709815ValidNon-revoked API Key Disclosure in a Disclosed API Key Disclosure Report on StripoStripo Inc · Cryptography · 2024–13votes
- #1613714ValidNon-revoked API Key Information disclosure via Stripo_report()Stripo Inc · Cryptography · 2022–13votes
- #996371ValidStored XSS at "Conditions " through "My Custom Rule" Field at [https://my.stripo.email/cabinet/#/template-editor/] in Template Editor.Stripo Inc · Cross-site Scripting · 2020–13votes
- #915541ValidCross-Site WebSocket Hijacking Lead to Steal XSRF-TOKENStripo Inc · Access Control · 2020–13votes
- #766533ValidCSRF - Modify Project SettingsStripo Inc · Cross-Site Request Forgery · 2020–13votes
- #754025ValidSSRF in Export template to ActiveCampaignStripo Inc · Server-Side Request Forgery · 2020–13votes
- #761382Validstripo blog search SQL InjectionStripo Inc · SQL Injection · 2020–12votes
- #753386ValidNo CSRF Protection in Resend Confirmation Email feature leads to Sending Unwanted Email in Victim's Inbox without knowing Victim's email addressStripo Inc · Cross-Site Request Forgery · 2020–12votes
- #737578ValidRedirection through referer tagStripo Inc · No weakness recorded · 2019–12votes
- #1057484InformativePermanent DOS for new users!Stripo Inc · Denial of Service · 2020–11votes
- #738553ValidSSRF in /cabinet/stripeapi/v1/siteInfoLookup?url=XXXStripo Inc · Server-Side Request Forgery · 2019–11votes
- #1055503InformativeNo rate limiting for confirmation email lead to huge Mass mailingsStripo Inc · Input Validation and Logic · 2020–9votes
- #823588ValidUnrestricted File Upload on https://my.stripo.email and https://stripo.emailStripo Inc · File and Path Handling · 2020–9votes
- #881186Valid[www.stripo.email] You can bypass the speed limit by changing the IP.Stripo Inc · Information Disclosure · 2020–8votes
- #788420ValidAuthorization for wp-admin directory are vulnerable to brute force.Stripo Inc · Authentication · 2020–8votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.