Browse / GitLab

GitLab

See its reports on the map

Attack surface: 785 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to GitLab

• Cross-site Scripting57
• Access Control53
• Information Disclosure32
• Code Execution18
• Server-Side Request Forgery18
• Misconfiguration16

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Adding everyone to the repo due to the lack of rate limitN/AInsecure Direct Object Reference (IDOR) · high
   8 votes
2. Double linking cause XSS (but blokeced by CSP in gitlab.com)N/ACross-site Scripting (XSS) - DOM · low
   6 votes
3. Guests Will Disclose the Private Project Full Activity Via Project Activity FeedsN/AInformation Disclosure
   5 votes
4. Email notification about login email changed is not received when using verified linked email addressN/AViolation of Secure Design Principles
   3 votes
5. No Restriction on passwordN/AImproper Authentication - Generic
   2 votes