Every disclosed bug, mapped to how it was found.
HexBrain is a map of 15,244 publicly disclosed bug bounty reports from 428 programs, grouped into 18 vulnerability classes and 215 weaknesses. Open a class, pick a weakness, and read how each bug was found, in the researcher's own words.
How to read the map
- Each node on the inner ring is a vulnerability class. Each strip beyond it is a weakness, and each dot in a strip is one report.
- Lines through the middle join classes that turn up in the same reports. Thicker lines mean more shared reports.
- The Programs view shows every program as a strip of its reports, with its logo inside the ring.
- Opening a program can mark its reports on the vulnerability map, to show where that program has been hit.
- The bypass library groups reports by the protection they got past: WAFs, filters, 2FA, earlier fixes and more.
Use it from an AI assistant
Claude, ChatGPT and other assistants can search the reports, read any write-up, pull a playbook for a bug class, and check what a program has already paid for. Access is read-only. Sign in with Google to create an API key and get the connection details.
Where the data comes from
- The list of reports comes from the open hackerone-reports dataset.
- Each write-up comes from that report's own public page on HackerOne. Every report here links back to it.
- The payloads and techniques section is PayloadsAllTheThings by Swissky and contributors, used under the MIT licence.
- The CVE library takes its checks from nuclei-templates (MIT licence), its exploited-in-the-wild list from CISA, and its likelihood scores from EPSS.
- Where a program filed a report without a weakness, the class shown is our guess from the title, and the report page says so.
- 9,875 write-ups are stored so far; the rest load from HackerOne the first time someone opens them.
Please use it responsibly
These reports describe real vulnerabilities that were fixed and then disclosed by the programs involved. Use them to learn and to test systems you are authorised to test, inside each program's scope.
HexBrain is an independent project. It is not affiliated with or endorsed by HackerOne or any program shown. Reports belong to their authors and the programs that disclosed them; program names and logos belong to their owners. To have something removed, contact the site owner.