HexBrain
Sign in

Browse / Instacart

Instacart

35disclosed reports
$1,200paid in bounties

See its reports on the map

What gets reported to Instacart

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. CSRF Trial 14 days express subscriptionCross-Site Request Forgery (CSRF)
    59 votes
  2. Race Condition in Redeeming CouponsViolation of Secure Design Principles
    43 votes
  3. Authorization Bypass in Delivery Chat LogsPrivilege Escalation
    $10035 votes
  4. Cross-Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF)
    33 votes
  5. Server side request forgery on image upload for listsCode Injection
    $5021 votes
  6. View & add to cart unlisted items via IDORInsecure Direct Object Reference (IDOR) · high
    19 votes
  7. Reverse Tab-nabbing at www.instacart.com/store/partner_recipe?recipe_url=
    19 votes
  8. Cross-Site Scripting Reflected On Main DomainCross-site Scripting (XSS) - Generic
    19 votes
  9. XSS at in instacart.com/store/partner_recipeCross-site Scripting (XSS) - Generic · low
    18 votes
  10. Host Header Injection/Redirection in: https://www.instacart.com/Open Redirect
    17 votes
  11. Stored XSSCross-site Scripting (XSS) - Generic
    17 votes
  12. Get all instacart emails - missing rate limit on /accounts/registerImproper Restriction of Authentication Attempts · medium
    $15016 votes
  13. Cookie-Based InjectionCross-site Scripting (XSS) - Generic
    16 votes
  14. Login with Google Not Authenticated on iOS AppImproper Authentication - Generic · low
    15 votes
  15. XSS in instacart.com/store/partner_recipeCross-site Scripting (XSS) - Generic · medium
    $10015 votes
  16. Bruteforcing password reset tokens, could lead to account takeoverImproper Restriction of Authentication Attempts · medium
    $5014 votes
  17. Hyperlink Injection in Friend Invitation EmailsOpen Redirect
    $10014 votes
  18. Full access to any listPrivilege Escalation
    $15013 votes
  19. [Critical] Subdomain TakeoverN/APrivilege Escalation
    13 votes
  20. Brute force login and bypass locked account restrictions via iOS appViolation of Secure Design Principles
    11 votes
  21. Issues with uploading list imagesUncontrolled Resource Consumption
    11 votes
  22. Authentication Bypass in Updating Personal InformationInformativeImproper Authentication - Generic
    10 votes
  23. shopper login_code's can be brute forcedImproper Authentication - Generic
    9 votes
  24. WordPress Authentication Denial of ServiceUncontrolled Resource Consumption
    $1008 votes
  25. CSRF To change Email Notification Settings Cross-Site Request Forgery (CSRF)
    8 votes
  26. READ .svg files by changing .svg into .png extensionViolation of Secure Design Principles
    7 votes
  27. Reflected File Download on recipe list searchInformativeCommand Injection - Generic
    7 votes
  28. Access private list metadataInformation Disclosure · low
    $1006 votes
  29. Fetch private list metadata and any user's personal nameInformation Disclosure
    $1506 votes
  30. Seemingly sensitive information at /api/v2/zonesInformation Disclosure
    $505 votes
  31. API OAuth Public Key disclosure in mobile appInformativeInformation Disclosure
    5 votes
  32. Image Upload Path DisclosureInformation Disclosure
    $1005 votes
  33. Missing rel=noreferrer tag allows link in list to change url of currently open tabViolation of Secure Design Principles
    4 votes
  34. CSRF with redeem coupon request InformativeCross-Site Request Forgery (CSRF)
    2 votes
  35. User Information sent to client through websocketsInformativeInformation Disclosure
    1 votes