Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| [Zomato Order] Insecure deeplink leads to sensitive information disclosureAnalysed#532225 | Valid | Eternal | No weakness recorded | High | 2021-09-23 | $750 | 114 |
| Twitter lite(Android): Vulnerable to local file steal, Javascript injection, Open redirectAnalysed#499348 | Valid | X / xAI | Access Control | Critical | 2019-04-29 | – | 95 |
| [Zomato Android/iOS] Theft of user sessionAnalysed#328486 | Valid | Eternal | No weakness recorded | – | 2018-06-17 | – | 68 |
| URL Scheme Validation Bypass in Shopify Mobile App Allows Javascript ExecutionAnalysed#1737358 | Valid | Shopify | Access Control | Low | 2025-09-17 | – | 65 |
| One Click Account Hijacking via Unvalidated DeeplinkAnalysed#1500614 | Valid | TikTok | Access Control | High | 2022-05-04 | – | 60 |
| [Zomato for Business Android] Vulnerability in exported activity WebViewAnalysed#537670 | Valid | Eternal | No weakness recorded | Medium | 2021-09-23 | – | 52 |
| Access of Android protected components via embedded intentAnalysed#200427 | Valid | Slack | Access Control | Critical | 2017-07-17 | – | 31 |
| code injection, steam chat clientAnalysed#411329 | Valid | Valve | Command and Code Injection | Medium | 2019-01-07 | $750 | 28 |
| Уязвимый класс WebViewAnalysed#452835 | Valid | VK.com | No weakness recorded | Medium | 2018-12-31 | $200 | 24 |
| com.basecamp.bc3 Webview Javascript Injection and JS bridge takeoverAnalysed#1343300 | Valid | Basecamp | Cross-site Scripting | High | 2022-09-23 | – | 21 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,614 analysed so far), which can be wrong. Data as of 2026-11-15.