Browse / Curve

Curve

See its reports on the map

Attack surface: 427 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Curve

• Information Disclosure1
• Business Logic1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Sensitive Info Leak - An Attacker Can Retrieve All the Users Mobile Numbers at https://website-api.production.curve.app/api/waitlist/usCleartext Transmission of Sensitive Information · medium
   79 votes
2. Business Logic Flaw - A non premium user can change/update retailers to get cashback on all the retailers associated with CurveBusiness Logic Errors · medium
   29 votes