Browse / Legal Robot

Legal Robot

See its reports on the map

Attack surface: 51 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Legal Robot

• Authentication40
• Misconfiguration35
• Other weaknesses26
• Information Disclosure18
• Business Logic12
• Access Control4

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Remote Code Execution (upload)Violation of Secure Design Principles
   60 votes
2. Big XSS vulnerability!SpamClassic Buffer Overflow · medium
   39 votes
3. Subdomain takeover at api.legalrobot.com due to non-used domain in Modulus.io.Violation of Secure Design Principles
   33 votes
4. Privilege Escalation to Admin-level AccountPrivilege Escalation
   25 votes
5. Bypass 8 chars password complexity with 6 chars only due to insecure password reset functionaliyViolation of Secure Design Principles
   21 votes
6. AWS hosting bucket for Legal Robots set as public browse and list contents: s3://legalrobotN/AInformation Disclosure
   21 votes
7. Intercom chat session information persists after logoutSession Fixation · low
   20 votes
8. Password complexity requirements not enforcedImproper Authentication - Generic · low
   18 votes
9. Homograph IDNs displayed in DescriptionViolation of Secure Design Principles
   17 votes
10. 2FA manual entry uses wrong encodingImproper Authentication - Generic · low
    15 votes
11. Domain takeover (legalrobot.co.za)Improper Authentication - Generic
    15 votes
12. Near-duplicate accounts allowed with ignored email mutationsImproper Authentication - Generic
    15 votes
13. Email Length Verification Spamhigh
    14 votes
14. Update any profileInsecure Direct Object Reference (IDOR)
    14 votes
15. Legal Robot AWS S3 Bucket Directory ListingInformation Disclosure · medium
    14 votes
16. design issue exists on login page SpamBusiness Logic Errors
    13 votes
17. TabNabbing issue (due to taget=_blank)Violation of Secure Design Principles
    13 votes
18. Code injectionResource Injection · low
    13 votes
19. 2FA Error Handling on Google AuthenticatorImproper Authentication - Generic
    13 votes
20. content spoofingSpamViolation of Secure Design Principles
    13 votes
21. Legal RobotSpamCRLF Injection
    12 votes
22. I cant login to my accountInformativeImproper Authentication - Generic
    12 votes
23. Change password session fixedSpamViolation of Secure Design Principles · low
    12 votes
24. Password complexity not evenly enforcedViolation of Secure Design Principles · low
    12 votes
25. Missing link to 2FA recovery codeBusiness Logic Errors · medium
    12 votes
26. Missing link to TOTP manual enroll optionBusiness Logic Errors · medium
    12 votes
27. Password reset access controlImproper Authentication - Generic · medium
    12 votes
28. Information Disclosure on rate limit defense mechanismInformation Disclosure · low
    12 votes
29. News Feed Detected SpamInformation Disclosure
    12 votes
30. Logic issue in email change processImproper Authentication - Generic · low
    11 votes
31. Logic issue in email change processUncontrolled Resource Consumption
    11 votes
32. AWS S3 website can't serve security headers, may allow clickjackingUI Redressing (Clickjacking)
    11 votes
33. Exposes a series of other private credentialsDuplicateInformation Disclosure
    10 votes
34. Failed OutLink on Terms of ServiceViolation of Secure Design Principles
    10 votes
35. Venturebeat.com URL should be HTTPSViolation of Secure Design Principles
    10 votes
36. Improper validation of parameters while creating issuesImproper Access Control - Generic
    10 votes
37. [Cross-domain Referer leakage] Password reset token leakage via refererInformation Disclosure · low
    10 votes
38. Enhancement: email confirmation for 2FA recoveryBusiness Logic Errors · medium
    10 votes
39. Information Disclosure in AWS S3 BucketInformation Disclosure
    10 votes
40. Password reset token issueImproper Authentication - Generic · low
    9 votes
41. first name and last name restrictions bypassIncorrect Calculation of Buffer Size
    9 votes
42. Change password logic inversionImproper Authentication - Generic
    9 votes
43. Meta characters are not filtered into full name on profile page
    9 votes
44. Pages don't render in old browsers like IE11
    9 votes
45. Missing Issuer parameter on TOTP 2FAImproper Authentication - Generic
    9 votes
46. User enumerationInformation Disclosure
    9 votes
47. 2FA user enumeration via loginBusiness Logic Errors · high
    9 votes
48. 2FA user enumeration via password resetBusiness Logic Errors · medium
    9 votes
49. Non-functional 2FA recovery codesImproper Access Control - Generic
    9 votes
50. Missing restriction on string size in profile fieldsUncontrolled Resource Consumption · medium
    9 votes
51. CORS (Cross-Origin Resource Sharing)Improper Authentication - Generic
    9 votes
52. User Information leak allows user to bypass email verification.Violation of Secure Design Principles
    9 votes
53. User Information sent to client through websocketsInformation Disclosure
    9 votes
54. Clickjacking in Legalrobot appUI Redressing (Clickjacking)
    8 votes
55. External links to be in HTTP
    8 votes
56. User enumeration from failed login error messageImproper Authentication - Generic · low
    8 votes
57. No notification on change password featureImproper Authentication - Generic
    8 votes
58. [New Feature] Password history checkImproper Authentication - Generic
    8 votes
59. Users with 2FA can have multiple sessionsImproper Authentication - Generic
    8 votes
60. Futureoflife organization URL should be HTTPS
    7 votes
61. Profile fields validation bypassImproper Authentication - Generic
    7 votes
62. Profile shows incorrect account creation date
    7 votes
63. Password Reset page Session FixationN/ASession Fixation · medium
    7 votes
64. Token leakage by referrerInformation Disclosure · medium
    7 votes
65. Validation bypass on user profileViolation of Secure Design Principles
    7 votes
66. Missing access control at password changeImproper Authentication - Generic
    7 votes
67. UI Redressing ( ClickJacking ) Issue on Information submit form DuplicateUI Redressing (Clickjacking)
    7 votes
68. SSL Issue on legalrobot.comImproper Authentication - Generic
    7 votes
69. - Guessing registered users in legalrobot.comImproper Authentication - Generic
    7 votes
70. CSRFCross-Site Request Forgery (CSRF)
    7 votes
71. Registration bypass using OAuth logical bugUI Redressing (Clickjacking)
    7 votes
72. No notification of change email featureUncontrolled Resource Consumption
    6 votes
73. observer.com URL should HTTPS
    6 votes
74. Password reset form ignores email fieldImproper Authentication - Generic
    6 votes
75. Server version disclosureInformation Disclosure
    6 votes
76. 2 vulns Informative
    6 votes
77. Email spoofing-fake mail from your mail domain server InformativeImproper Authentication - Generic
    6 votes
78. SPF Issue Improper Authentication - Generic
    6 votes
79. missing SPF for legalrobot.com Improper Authentication - Generic
    6 votes
80. External links should be served in HTTPS.InformativeViolation of Secure Design Principles · low
    5 votes
81. Improper Implementation of Password strength checkerViolation of Secure Design Principles
    5 votes
82. Missing homograph filter characterViolation of Secure Design Principles
    5 votes
83. Wrong password validation messageViolation of Secure Design Principles
    5 votes
84. Header Injection In app.legalrobot.comInformativeOpen Redirect
    5 votes
85. UX: JS error on Password Safety linkBusiness Logic Errors
    5 votes
86. CSP script-src includes "unsafe-inline"
    5 votes
87. 2FA manual entry uses wrong encodingBusiness Logic Errors
    5 votes
88. Incorrect email content when disabling 2FABusiness Logic Errors
    5 votes
89. Lengthy manual entry of 2FA secretBusiness Logic Errors
    5 votes
90. Issues with Forgot password Error Handling Business Logic Errors
    5 votes
91. No error or notification on Reset password pageImproper Authentication - Generic
    5 votes
92. [UX] Notify user on likely email address typo
    5 votes
93. sql injection vulnerablity foundN/ASQL Injection
    5 votes
94. Click JackingDuplicateUI Redressing (Clickjacking)
    5 votes
95. No valid SPF recordImproper Authentication - Generic
    5 votes
96. Missing security headers, possible clickjackingUI Redressing (Clickjacking)
    5 votes
97. Broken links for stale domains may be leveraged for Phishing, Misinformation, DefamingInformation Disclosure
    4 votes
98. Autocomplete feature
    4 votes
99. Bypass email verification when register new accountN/AImproper Access Control - Generic
    4 votes
100. UX: JS error on Password Safety linkImproper Authentication - Generic
     4 votes