Intel · bug bounty

Disclosed bug bounty reports

Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.

SortMost upvoted

StatusValid

SeverityAny

DisclosedAny year

WeaknessAny class

Access (title)Any

Access (analysis)Any

TechniqueAny

Clear

12,095 of 15,219 reports · $4,536,806 in bounties · 161 analysed so far

#867513ValidAnalysedTakeover an account that doesn't have a Shopify ID and moreShopify · No weakness recorded · 2020 · needs: a user account · E-mail verification bypass, Account takeover chain, Business logic flaw–3,006votes
#510152ValidAnalysedBypass for #488147 enables stored XSS on https://paypal.com/signin againPayPal · Injection and Smuggling · 2019 · needs: no account · Request smuggling, Cache poisoning$20,0002,687votes
#791775ValidAnalysedEmail Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSOShopify · No weakness recorded · 2020 · needs: a user account · E-mail verification bypass, Account takeover chain, Authentication bypass–1,922votes
#745324ValidAnalysedAccount takeover via leaked session cookieHackerOne · Authentication · 2019 · needs: no account · Account takeover chain, Session fixation or reuse, Information disclosure$20,0001,642votes
#1087489ValidAnalysedGithub access token exposureShopify · No weakness recorded · 2021 · needs: no account · Leaked secret or key, Information disclosure$50,0001,601votes
#827052ValidAnalysedArbitrary file read via the UploadsRewriter when moving and issueGitLab · File and Path Handling · 2020 · needs: a user account · Path traversal, Local file inclusion$20,0001,503votes
#739737ValidAnalysedToken leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordPayPal · Authentication · 2020 · needs: no account · Information disclosure, Authentication bypass$15,3001,409votes
#470520ValidAnalysedRCE on Steam Client via buffer overflow in Server InfoValve · Memory Corruption · 2019 · needs: no account · Memory corruption, Code injection / eval–1,289votes
#591295ValidAnalysedPotential pre-auth RCE on Twitter VPNX / xAI · Command and Code Injection · 2019 · needs: no account · Path traversal, Information disclosure, 2FA bypass, Session fixation or reuse$20,1601,246votes
#455645ValidAnalysedExposed Kubernetes API - RCE/Exposed CredsSnapchat · Command and Code Injection · 2021 · needs: no account · Missing authorisation check, OS command injection, Leaked secret or key$25,0001,191votes
#489146ValidAnalysedConfidential data of users and limited metadata of programs and reports accessible via GraphQLHackerOne · Information Disclosure · 2019 · needs: not clear from the report · Missing authorisation check, Information disclosure–1,033votes
#2293343ValidAnalysedAccount Takeover via Password Reset without user interactionsGitLab · Access Control · 2025 · Critical · needs: no account · Account takeover chain, Password reset flaw, Parameter pollution$35,000989votes
#921780ValidAnalysedImproper Authentication - any user can login as other user with otp/logout & otp/loginSnapchat · Authentication · 2021 · needs: a user account · Authentication bypass, Account takeover chain, IDOR / object reference–972votes
#925585ValidAnalysedRCE via npm misconfig -- installing internal libraries from the public registryPayPal · Command and Code Injection · 2021 · needs: no account · Dependency confusion / supply chain$30,000946votes
#796808ValidAnalysed[Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege EscalationShopify · No weakness recorded · 2020 · needs: a user account · E-mail verification bypass, Account takeover chain–894votes
#737140ValidAnalysedMass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookiesSlack · Injection and Smuggling · 2020 · needs: no account · Request smuggling, Account takeover chain, Information disclosure–870votes
#622122ValidAnalysedDoS on PayPal via web cache poisoningPayPal · Denial of Service · 2019 · needs: no account · Cache poisoning, Denial of service, Request smuggling$9,700851votes
#422944ValidAnalysedH1514 Remote Code Execution on kitcrm using bulk customer update of Priority ProductsShopify · Command and Code Injection · 2020 · needs: a user account · Unsafe file upload, OS command injection, SSRF–830votes
#403417ValidAnalysedRemote Code Execution on www.semrush.com/my_reports on Logo uploadSemrush · Command and Code Injection · 2019 · needs: a user account · OS command injection, Unsafe file upload–824votes
#228648ValidAnalysedWannaCrypt “Killswitch”HackerOne · No weakness recorded · 2017 · needs: no account · Business logic flaw–809votes
#1819832ValidAnalysedDelete anyone's content spotlight remotely.Snapchat · Insecure Direct Object Reference · 2023 · needs: a user account · IDOR / object reference, Missing authorisation check$15,000801votes
#531051ValidAnalysedSQL Injection Extracts Starbucks Enterprise Accounting, Financial, Payroll DatabaseStarbucks · SQL Injection · 2019 · needs: no account · SQL injection–801votes
#415081ValidAnalysedIDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/usersPayPal · Insecure Direct Object Reference · 2019 · needs: a user account · IDOR / object reference, Missing authorisation check$10,500797votes
#335330ValidAnalysedSubdomain Takeover to Authentication bypassRoblox · No weakness recorded · 2020 · needs: no account · Subdomain takeover, Blind XSS, CORS misconfiguration, Account takeover chain–783votes
#873614ValidAnalysedWebsites Can Run Arbitrary Code on Machines Running the 'PlayStation Now' ApplicationPlayStation · Command and Code Injection · 2020 · needs: a user account · Code injection / eval$15,000780votes
#658013ValidAnalysedGit flag injection - local file overwrite to remote code executionGitLab · Command and Code Injection · 2019 · needs: a user account · OS command injection, Path traversal$12,000777votes
#446585ValidAnalysedExfiltrate and mutate repository and project data through injected templated serviceGitLab · Access Control · 2019 · needs: a user account · Missing authorisation check, Information disclosure, SSRF$11,000762votes
#826026ValidAnalysedUse-After-Free In IPV6_2292PKTOPTIONS leading To Arbitrary Kernel R/W PrimitivesPlayStation · Memory Corruption · 2020 · needs: a user account · Race condition, Memory corruption, Privilege escalation$10,000741votes
#716292ValidAnalysedJumpCloud API Key leaked via Open Github Repository.Starbucks · Authentication · 2019 · needs: no account · Leaked secret or key, Missing authorisation check–739votes
#297478ValidAnalysedSQL injection in https://labs.data.gov/dashboard/datagov/csv_to_json via User-agentGSA Bounty · SQL Injection · 2019 · needs: no account · SQL injection–699votes
#506646ValidAnalysedWebshell via File Upload on ecjobs.starbucks.com.cnStarbucks · Command and Code Injection · 2019 · needs: a user account · Unsafe file upload, OS command injection–688votes
#488147ValidAnalysedStored XSS on https://paypal.com/signin via cache poisoningPayPal · Injection and Smuggling · 2019 · needs: no account · Request smuggling, Cache poisoning$18,900685votes
#846338ValidReflected XSS on https://www.glassdoor.com/employers/sem-dual-lp/Glassdoor · Cross-site Scripting · 2020–684votes
#792927ValidAnalysedEmail address of any user can be queried on Report Invitation GraphQL type when username is knownHackerOne · Access Control · 2020 · needs: a user account · Missing authorisation check, Information disclosure–671votes
#885975ValidMy Expense Report resulted in a Server-Side Request Forgery (SSRF) on LyftLyft · No weakness recorded · 2020–653votes
#542340ValidAnalysedSensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameterUber · Information Disclosure · 2019 · needs: no account · Missing authorisation check, IDOR / object reference, Leaked secret or key–643votes
#391217ValidAnalysedGetting all the CD keys of any gameValve · Access Control · 2018 · needs: a user account · Missing authorisation check, IDOR / object reference, Information disclosure$20,000638votes
#322985ValidAnalysedAbility to reset password for accountUpserve · Access Control · 2019 · needs: no account · Authentication bypass, Business logic flaw–637votes
#526325ValidAnalysedStored XSS in Wiki pagesGitLab · Cross-site Scripting · 2019 · needs: a user account · Stored XSS–633votes
#868436ValidTime-Based SQL injection at city-mobil.ruMail.ru · SQL Injection · 2020$15,000631votes
#3000510ValidAnalysedThe /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is presentHackerOne · Information Disclosure · 2025 · Critical · needs: no account · Information disclosure–625votes
#129873ValidAnalysedBypassing Digits origin validation which leads to account takeoverX / xAI · Authentication · 2020 · needs: a user account · Authentication bypass, postMessage flaw, Account takeover chain–619votes
#484434ValidAnalysedStored XSS on imgur profileImgur · Cross-site Scripting · 2019 · needs: a user account · Stored XSS–614votes
#807448ValidAnalysedCustomer private program can disclose email any users through invited via usernameHackerOne · Information Disclosure · 2020 · needs: a user account · Information disclosure, Missing authorisation check$7,500589votes
#341876ValidSSRF in Exchange leads to ROOT access in all instancesShopify · Server-Side Request Forgery · 2018–587votes
#396467ValidAnalysedGithub Token Leaked publicly for https://github.sc-corp.netSnapchat · Cryptography · 2018 · needs: no account · Leaked secret or key–582votes
#639684ValidAnalysedThe return of the ＜Rockstar Games · Cross-site Scripting · 2019 · needs: a user account · Stored XSS$1,000576votes
#502758ValidAnalysedRCE and Complete Server Takeover of http://www.█████.starbucks.com.sg/Starbucks · Command and Code Injection · 2019 · needs: no account · Path traversal, Unsafe deserialisation, Code injection / eval, Missing authorisation check–572votes
#740037ValidAnalysedRequest smuggling on admin-official.line.me could lead to account takeoverLY Corporation · Injection and Smuggling · 2020 · needs: not clear from the report · Request smuggling, Account takeover chain–565votes
#313457ValidAnalysedPublicly accessible Continuous Integration ToolSnapchat · Access Control · 2021 · needs: no account · Missing authorisation check, Information disclosure, Leaked secret or key–562votes

The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.