Browse / Alohi

Alohi

See its reports on the map

Attack surface: 88 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Alohi

• Business Logic2
• Access Control1
• Authentication1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Misconfigured rate limit for SMS phone verification endpointBusiness Logic Errors · medium
   26 votes
2. Misconfigured rate limit at app.sign.plus/forgot_passwordBusiness Logic Errors · low
   25 votes
3. Waitlist bypass for accessing SIGN.PLUS BetaImproper Access Control - Generic · low
   11 votes
4. Weak rate limit for SIGN.PLUS email verificationImproper Restriction of Authentication Attempts · low
   3 votes