HexBrain
Sign in

Browse / Gratipay

Gratipay

136disclosed reports
$146paid in bounties

See its reports on the map

What gets reported to Gratipay

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. Saying goodbye to HackerOne and Gratipay.
    96 votes
  2. Reflected XSS - gratipay.comCross-site Scripting (XSS) - Reflected · medium
    36 votes
  3. configure a redirect URI for Facebook OAuthImproper Authentication - Generic · medium
    18 votes
  4. Sub Domain Takeover
    16 votes
  5. Application-level DoS on image's "size" parameter.Uncontrolled Resource Consumption · high
    15 votes
  6. fix bug in username restrictionViolation of Secure Design Principles · medium
    15 votes
  7. change bank account numbersInformation Disclosure · medium
    13 votes
  8. Content length restriction bypass can lead to DOS by reading large files on gip.rocksUncontrolled Resource Consumption · high
    11 votes
  9. Limit email address lengthImproper Authentication - Generic · low
    11 votes
  10. Gratipay rails secret token (secret_key_base) publicly exposed in GitHubCleartext Storage of Sensitive Information · medium
    10 votes
  11. HTTP trace method is enabled on aspen.ioViolation of Secure Design Principles · low
    10 votes
  12. upgrade Aspen on inside.gratipay.com to pick up CR injection fixCross-site Scripting (XSS) - Generic · high
    $409 votes
  13. Sub Domain Take overImproper Authentication - Generic · medium
    9 votes
  14. CSV injection in gratipay.com via payment history export feature.Command Injection - Generic · medium
    8 votes
  15. Inadequate/dangerous jQuery behaviorViolation of Secure Design Principles · low
    8 votes
  16. Email Forgery through Mandrillapp SPFImproper Authentication - Generic · medium
    $108 votes
  17. protect against tabnabbing in statementImproper Authentication - Generic · medium
    8 votes
  18. Stored XSS On StatementCross-site Scripting (XSS) - Generic · high
    8 votes
  19. Avoid "resend verification email" confusionCross-Site Request Forgery (CSRF) · low
    $17 votes
  20. Incomplete or No Cache-control and Pragma HTTP Header Setlow
    6 votes
  21. suppress version in Server header on gratipay.com or grtp.coInformation Disclosure · low
    $16 votes
  22. No Valid SPF Records.Improper Authentication - Generic · medium
    $106 votes
  23. [gratipay.com] CRLF InjectionCRLF Injection · high
    $406 votes
  24. weak ssl cipher suitesCryptographic Issues - Generic · low
    6 votes
  25. Content-Length restriction bypass to heap overflow in gip.rocks.Heap Overflow · high
    5 votes
  26. HTTP trace method is enabled on gip.rocksViolation of Secure Design Principles · medium
    5 votes
  27. Content Spoofing/Text Injection Violation of Secure Design Principles · low
    $15 votes
  28. don't serve hidden files from NginxInformation Disclosure · low
    $15 votes
  29. Prevent content spoofing on /~username/emails/verify.htmlCross-Site Request Forgery (CSRF) · medium
    5 votes
  30. Harden resend throttlingViolation of Secure Design Principles · medium
    5 votes
  31. Hijacking user session by forcing the use of invalid HTTPs Certificate on images.gratipay.comInformation Disclosure · low
    4 votes
  32. strengthen Diffie-Hellman (DH) key exchange parameters in grtp.coImproper Authentication - Generic · low
    4 votes
  33. SPF/DKIM/DMARC for aspen.ioImproper Authentication - Generic · medium
    4 votes
  34. limit HTTP methods on other domainsViolation of Secure Design Principles · low
    4 votes
  35. HTTP trace method is enabledViolation of Secure Design Principles · low
    4 votes
  36. bring grtp.co up to A grade on SSLLabsViolation of Secure Design Principles · low
    3 votes
  37. Send email asynchronouslyUncontrolled Resource Consumption · medium
    $103 votes
  38. stop serving grtp.co over HTTPInformation Disclosure · low
    $13 votes
  39. The POODLE attack (SSLv3 supported) for https://grtp.co/Cryptographic Issues - Generic · low
    3 votes
  40. Mail spamingViolation of Secure Design Principles · low
    $203 votes
  41. limit number of images in statementViolation of Secure Design Principles · medium
    $12 votes
  42. SPF/DKIM/DMARC for grtp.coViolation of Secure Design Principles · medium
    2 votes
  43. DKIM records not present, Email Hijacking is possibleImproper Authentication - Generic · medium
    2 votes
  44. Possible SQL injection on "Jump to twitter"SQL Injection · low
    2 votes
  45. Self XSS Protection not used , I can trick users to insert JavaScriptCross-site Scripting (XSS) - Generic · medium
    2 votes
  46. don't leak server version of grtp.co in error pagesInformation Disclosure · low
    1 votes
  47. Cookie Does Not Contain The "secure" AttributeViolation of Secure Design Principles · low
    1 votes
  48. DMARC is misconfigured for grtp.coViolation of Secure Design Principles · medium
    $101 votes
  49. prevent content spoofing on /searchViolation of Secure Design Principles · medium
    1 votes
  50. SPF DNS Record Violation of Secure Design Principles · medium
    1 votes