Browse / Courier

Courier

See its reports on the map

Attack surface: 51 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Courier

• Authentication6
• Denial of Service3
• Misconfiguration2
• Access Control1
• Cross-Site Request Forgery1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Broken Authentication Session Token BugInsufficient Session Expiration · medium
   35 votes
2. Missing rate limit in signup Form Improper Authentication - Generic · medium
   19 votes
3. Rate limit function bypass can leads to occur huge critical problem into website. Improper Access Control - Generic · medium
   16 votes
4. [OPEN S3 BUCKET] All uploaded files are public. Misconfiguration · medium
   16 votes
5. 2 Bypass of #1067533 rate limit via X-Forwarded-For<space>: Source IP on ( www.trycourier.app )Uncontrolled Resource Consumption · medium
   15 votes
6. disable test send feature if user's email address isn't verifiedUncontrolled Resource Consumption · high
   13 votes
7. Session Fixiation allow attacker to create new evil workspace without being logged in [ Insecure Session management ]Session Fixation · medium
   12 votes
8. Possible to invite any team member without being logged in. [ Session Management Issue ]Insufficient Session Expiration · medium
   12 votes
9. [3] Bypassing IP Based Rate Limit Blocking leads to rate limit bypass in Courier Login PanelUncontrolled Resource Consumption
   10 votes