Browse / Ed

Ed

See its reports on the map

Attack surface: 142 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Ed

• Information Disclosure3
• Denial of Service2
• Access Control2
• Open Redirect1
• Authentication1
• Cross-site Scripting1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Physical Laptop TakeoverPrivacy Violation · critical
   380 votes
2. Possible to redirect to a (non-existing) subdomain after logging in via GitHub (leaking the token)Open Redirect · high
   71 votes
3. Oauth flow on the comments widget login can lead to the access code leakageImproper Authentication - Generic · low
   43 votes
4. Chrome Extension is vulnerable to the self-DOS issues in case it process the security.txt with a big sizeUncontrolled Resource Consumption · low
   32 votes
5. Domain takeover on http://doesfranshaveashell.com/ due to expirationPrivilege Escalation · low
   31 votes
6. DOM XSS in edoverflow.com/tools/respond due to unsafe usage of the innerHTML property.Cross-site Scripting (XSS) - DOM · low
   28 votes
7. securitytemplate.site domain hijackImproper Access Control - Generic · medium
   16 votes
8. Fix for self-DoS in Security-txt Chrome Extension.Uncontrolled Resource Consumption · low
   10 votes
9. Session cookie missing SecureFlag on git.edoverflow.com.Information Disclosure · medium
   6 votes