Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Ability to getting Twitter Blue verified badge without purchase it#1841064 | Duplicate | Input Validation and Logic | Medium | 2024-02-22 | – | 85 |
| CSRF on https://www.niche.co leads to "account disconnection"#493552 | Duplicate | Cross-Site Request Forgery | Medium | 2019-03-02 | – | 35 |
| http request smuggling in twitter.com#715996 | Duplicate | Injection and Smuggling | High | 2020-11-18 | – | 17 |
| PI leakage By Brute Forcing and Phone number deleting without using password#1087525 | Duplicate | Access Control | Medium | 2021-04-22 | – | 16 |
| Html Injection and Possible XSS via MathML#502926 | Duplicate | Cross-site Scripting | Critical | 2019-09-03 | – | 13 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,614 analysed so far), which can be wrong. Data as of 2026-11-15.