Browse / HackerOne

HackerOne

See its reports on the map

Attack surface: 127 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to HackerOne

• Information Disclosure160
• Misconfiguration99
• Access Control71
• Authentication48
• Business Logic40
• Cross-site Scripting32

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Cloud Computer Hackerone Triager can be Accessible for everyone [[email protected]] computerInformativeBusiness Logic Errors
   91 votes
2. [hackerone.com] Program's old handles are not blacklisted like usernames and allows reclaim over past handles for potential abuseInformativeViolation of Secure Design Principles · medium
   81 votes
3. Private data related to program exposed via /reports/<id>.json endpoint to external user participantInformativeInformation Disclosure · medium
   68 votes
4. Bypassing the victim's phone number OTP in the account recovery process on the https://hackerone.com/settings/auth/setup_account_recoveryInformativeImproper Authentication - Generic · critical
   67 votes
5. LLM03: Training Data Poisoning via ASCII decoding InformativeLLM01: Prompt Injection
   61 votes
6. Bypass comment restrictionInformativeImproper Access Control - Generic · medium
   48 votes
7. Issue with VDP Program's Transition to Private Status and Missing Warning Labels on ORG InvitationInformativeImproper Access Control - Generic · medium
   33 votes
8. Reports submitted by a non 2fa setupped user account can be transferred to a 2fa require submission program InformativeImproper Access Control - Generic · low
   32 votes
9. Hacker can bypass minimum bounty amount restrictions in "invitation preferences" setting via UpdateInvitationPreferencesMutation GraphQL operationInformativeClient-Side Enforcement of Server-Side Security · low
   29 votes
10. 2FA Bypass via Leaked CookiesInformativeImproper Authentication - Generic · medium
    28 votes
11. Session Not Expire / 2FA BypassInformativeInsufficient Session Expiration · medium
    28 votes
12. 2fa can't be activated on app.pullrequest.comInformativeViolation of Secure Design Principles
    25 votes
13. report id is exposed for undisclosed reports in HacktivityInformativeInformation Disclosure · low
    24 votes
14. Hackerone Email Addresses EnumerationInformativeInformation Disclosure
    24 votes
15. HackerOne is still prone to Internet Explorer UXSSInformativeCross-Site Request Forgery (CSRF)
    23 votes
16. Login page password-guessing attackInformativeImproper Authentication - Generic
    23 votes
17. 2FA requirement bypass when claiming bounty InformativeBusiness Logic Errors
    22 votes
18. Enumeration of usersInformativeViolation of Secure Design Principles
    20 votes
19. TOTP Authenticator implementation Accepts Expired CodesInformativeImproper Authentication - Generic · high
    19 votes
20. Exposing hackerone users personally identifiable information by abusing sandbox with swag reward enabledInformativeInformation Disclosure
    18 votes
21. Improper data update process on UpdatePhabricatorIntegration mutation leads to leak of Phabricator Conduit API token.InformativeInformation Disclosure · critical
    16 votes
22. Enumerating HackerOne PentestsInformativeMisconfiguration · low
    16 votes
23. Hackers can reveal the names of private programs that have an external linkInformativeInformation Disclosure · low
    16 votes
24. Submitted reports state logs leakageInformativeInformation Disclosure · medium
    16 votes
25. Account takeoverInformativeImproper Authentication - Generic
    16 votes
26. Manipulate report timeline activity by using null byte.InformativeViolation of Secure Design Principles
    12 votes
27. Unauthorized Team members viewingInformativeImproper Authentication - Generic
    12 votes
28. While adding a payment method - Notification email not sent to newly added email ID as well as there is no verification for new email id (Paypal)InformativeViolation of Secure Design Principles · low
    10 votes
29. Missing Password Confirmation at a Critical Function (Payout Method)InformativeViolation of Secure Design Principles · medium
    10 votes
30. Reward Money LeakageInformativeInformation Disclosure
    10 votes
31. Session Hijacking attack (Different Scenario)InformativeImproper Authentication - Generic
    10 votes
32. "early preview" programs disclosureInformativeInformation Disclosure
    9 votes
33. Leakage badges on disabled userInformativeInformation Disclosure · low
    8 votes
34. Information leakage - Private reports cached by Google InformativeInformation Disclosure
    8 votes
35. Email changingInformativeUncontrolled Resource Consumption
    8 votes
36. Adding an user email address to the list before confirming.InformativeViolation of Secure Design Principles
    8 votes
37. Ajouter le même utilisateur que celui déjà inscrit dans les équipesInformative
    7 votes
38. Open redirect deceive in hackerone.com via another open redirect link.InformativeOpen Redirect · low
    7 votes
39. Partial disclosure of undisclosed programs through <meta> tagsInformativeInformation Disclosure
    6 votes
40. Logical Issue (Boosting Reputation points)Informative
    6 votes
41. Flooding mailbox of userInformativeViolation of Secure Design Principles
    6 votes
42. harvesting attack on user registrationInformative
    6 votes
43. Information Disclosure which violate program privacyInformativePrivacy Violation · low
    5 votes
44. Possible XSSInformativeCross-site Scripting (XSS) - Generic
    5 votes
45. Substantially weakened authenticity verification when using 'Remember me for a week'InformativeCryptographic Issues - Generic
    5 votes
46. No option to logout concurrent sessionsInformativeImproper Authentication - Generic
    5 votes
47. Issue with password change in Disabled AccountInformativeViolation of Secure Design Principles · low
    4 votes
48. HackerOne Private Programs users disclosure and de-anonymous-izeInformativeInformation Disclosure
    4 votes
49. Account Hijacking (Only rare case scenario)InformativeImproper Authentication - Generic
    4 votes
50. Arbitrary file uploads to Amazon WS.InformativeViolation of Secure Design Principles
    4 votes
51. (lack of) smtp transport layer securityInformativeCryptographic Issues - Generic
    4 votes
52. Reverse Tabnabbing Vulnerability in Outgoing LinksInformativeViolation of Secure Design Principles · medium
    3 votes
53. Abusing HOF rankings in limited circumstancesInformativeViolation of Secure Design Principles
    3 votes
54. Pending member invitations are not revoked on program name changeInformativeInformation Disclosure
    2 votes
55. Denial of service in report view.InformativeUncontrolled Resource Consumption
    2 votes
56. Notification of previous signed out user leakage.InformativeInformation Disclosure
    2 votes