Browse / HackerOne

HackerOne

See its reports on the map

Attack surface: 127 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to HackerOne

• Information Disclosure160
• Misconfiguration99
• Access Control71
• Authentication48
• Business Logic40
• Cross-site Scripting32

Most upvoted reports

AllValidInformativeN/ADuplicate

1. View any user email using the Team's audit log sectionDuplicateInformation Disclosure · critical
   61 votes
2. Two factor authentication bypassDuplicateImproper Authentication - Generic · medium
   47 votes
3. Business Logic error leads to bypass 2FA requirement DuplicateBusiness Logic Errors · high
   39 votes
4. Reset the 2FA of the user which can lead to Account TakeoverDuplicateImproper Access Control - Generic · medium
   37 votes
5. Two-factor authentication bypass lead to information disclosure about the program and all hackers participateDuplicateInformation Disclosure · high
   37 votes
6. Timing attack towards endpoints on the web without CSRF DuplicateInformation Disclosure · low
   34 votes
7. Bypassing Two-Factor Authentication via Account Deactivation and Password ResetDuplicateImproper Access Control - Generic
   33 votes
8. IDOR on Program Visibilty (Revealed / Concealed) against other team membersDuplicateInsecure Direct Object Reference (IDOR) · medium
   33 votes
9. Improper Authentication - 2FA OTP ReusableDuplicateImproper Authentication - Generic · high
   31 votes
10. Able To Check The Exact Bounty Balance of any Bug Bounty ProgramDuplicateInformation Disclosure · medium
    27 votes
11. Introspection query leaks sensitive graphql system information.DuplicateViolation of Secure Design Principles
    22 votes
12. Lack of cross-origin request blocking allows leaking of sensitive information on several endpointsDuplicateInformation Disclosure
    15 votes
13. Hackers can Invite Collaborators Without 2FA on Programs Requiring 2FADuplicateImproper Authentication - Generic · medium
    13 votes
14. javascript: and mailto: links are allowed in JIRA integration settingsDuplicateViolation of Secure Design Principles · low
    12 votes
15. Information disclosureDuplicateInformation Disclosure · low
    8 votes
16. Private Program all members disclosed DuplicateInformation Disclosure
    8 votes
17. Email Address LeakDuplicateInformation Disclosure
    4 votes