Browse / Legal Robot

Legal Robot

See its reports on the map

Attack surface: 51 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Legal Robot

• Authentication40
• Misconfiguration35
• Other weaknesses26
• Information Disclosure18
• Business Logic12
• Access Control4

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Remote Code Execution (upload)Violation of Secure Design Principles
   60 votes
2. Subdomain takeover at api.legalrobot.com due to non-used domain in Modulus.io.Violation of Secure Design Principles
   33 votes
3. Privilege Escalation to Admin-level AccountPrivilege Escalation
   25 votes
4. Bypass 8 chars password complexity with 6 chars only due to insecure password reset functionaliyViolation of Secure Design Principles
   21 votes
5. Intercom chat session information persists after logoutSession Fixation · low
   20 votes
6. Password complexity requirements not enforcedImproper Authentication - Generic · low
   18 votes
7. Homograph IDNs displayed in DescriptionViolation of Secure Design Principles
   17 votes
8. 2FA manual entry uses wrong encodingImproper Authentication - Generic · low
   15 votes
9. Domain takeover (legalrobot.co.za)Improper Authentication - Generic
   15 votes
10. Near-duplicate accounts allowed with ignored email mutationsImproper Authentication - Generic
    15 votes
11. Update any profileInsecure Direct Object Reference (IDOR)
    14 votes
12. Legal Robot AWS S3 Bucket Directory ListingInformation Disclosure · medium
    14 votes
13. TabNabbing issue (due to taget=_blank)Violation of Secure Design Principles
    13 votes
14. Code injectionResource Injection · low
    13 votes
15. 2FA Error Handling on Google AuthenticatorImproper Authentication - Generic
    13 votes
16. Password complexity not evenly enforcedViolation of Secure Design Principles · low
    12 votes
17. Missing link to 2FA recovery codeBusiness Logic Errors · medium
    12 votes
18. Missing link to TOTP manual enroll optionBusiness Logic Errors · medium
    12 votes
19. Password reset access controlImproper Authentication - Generic · medium
    12 votes
20. Information Disclosure on rate limit defense mechanismInformation Disclosure · low
    12 votes
21. Logic issue in email change processImproper Authentication - Generic · low
    11 votes
22. Logic issue in email change processUncontrolled Resource Consumption
    11 votes
23. AWS S3 website can't serve security headers, may allow clickjackingUI Redressing (Clickjacking)
    11 votes
24. Failed OutLink on Terms of ServiceViolation of Secure Design Principles
    10 votes
25. Venturebeat.com URL should be HTTPSViolation of Secure Design Principles
    10 votes
26. Improper validation of parameters while creating issuesImproper Access Control - Generic
    10 votes
27. [Cross-domain Referer leakage] Password reset token leakage via refererInformation Disclosure · low
    10 votes
28. Enhancement: email confirmation for 2FA recoveryBusiness Logic Errors · medium
    10 votes
29. Information Disclosure in AWS S3 BucketInformation Disclosure
    10 votes
30. Password reset token issueImproper Authentication - Generic · low
    9 votes
31. first name and last name restrictions bypassIncorrect Calculation of Buffer Size
    9 votes
32. Change password logic inversionImproper Authentication - Generic
    9 votes
33. Meta characters are not filtered into full name on profile page
    9 votes
34. Pages don't render in old browsers like IE11
    9 votes
35. Missing Issuer parameter on TOTP 2FAImproper Authentication - Generic
    9 votes
36. User enumerationInformation Disclosure
    9 votes
37. 2FA user enumeration via loginBusiness Logic Errors · high
    9 votes
38. 2FA user enumeration via password resetBusiness Logic Errors · medium
    9 votes
39. Non-functional 2FA recovery codesImproper Access Control - Generic
    9 votes
40. Missing restriction on string size in profile fieldsUncontrolled Resource Consumption · medium
    9 votes
41. CORS (Cross-Origin Resource Sharing)Improper Authentication - Generic
    9 votes
42. User Information leak allows user to bypass email verification.Violation of Secure Design Principles
    9 votes
43. User Information sent to client through websocketsInformation Disclosure
    9 votes
44. Clickjacking in Legalrobot appUI Redressing (Clickjacking)
    8 votes
45. External links to be in HTTP
    8 votes
46. User enumeration from failed login error messageImproper Authentication - Generic · low
    8 votes
47. No notification on change password featureImproper Authentication - Generic
    8 votes
48. [New Feature] Password history checkImproper Authentication - Generic
    8 votes
49. Users with 2FA can have multiple sessionsImproper Authentication - Generic
    8 votes
50. Futureoflife organization URL should be HTTPS
    7 votes
51. Profile fields validation bypassImproper Authentication - Generic
    7 votes
52. Profile shows incorrect account creation date
    7 votes
53. Token leakage by referrerInformation Disclosure · medium
    7 votes
54. Validation bypass on user profileViolation of Secure Design Principles
    7 votes
55. Missing access control at password changeImproper Authentication - Generic
    7 votes
56. SSL Issue on legalrobot.comImproper Authentication - Generic
    7 votes
57. - Guessing registered users in legalrobot.comImproper Authentication - Generic
    7 votes
58. CSRFCross-Site Request Forgery (CSRF)
    7 votes
59. Registration bypass using OAuth logical bugUI Redressing (Clickjacking)
    7 votes
60. No notification of change email featureUncontrolled Resource Consumption
    6 votes
61. observer.com URL should HTTPS
    6 votes
62. Password reset form ignores email fieldImproper Authentication - Generic
    6 votes
63. Server version disclosureInformation Disclosure
    6 votes
64. SPF Issue Improper Authentication - Generic
    6 votes
65. missing SPF for legalrobot.com Improper Authentication - Generic
    6 votes
66. Improper Implementation of Password strength checkerViolation of Secure Design Principles
    5 votes
67. Missing homograph filter characterViolation of Secure Design Principles
    5 votes
68. Wrong password validation messageViolation of Secure Design Principles
    5 votes
69. UX: JS error on Password Safety linkBusiness Logic Errors
    5 votes
70. CSP script-src includes "unsafe-inline"
    5 votes
71. 2FA manual entry uses wrong encodingBusiness Logic Errors
    5 votes
72. Incorrect email content when disabling 2FABusiness Logic Errors
    5 votes
73. Lengthy manual entry of 2FA secretBusiness Logic Errors
    5 votes
74. Issues with Forgot password Error Handling Business Logic Errors
    5 votes
75. No error or notification on Reset password pageImproper Authentication - Generic
    5 votes
76. [UX] Notify user on likely email address typo
    5 votes
77. No valid SPF recordImproper Authentication - Generic
    5 votes
78. Missing security headers, possible clickjackingUI Redressing (Clickjacking)
    5 votes
79. Broken links for stale domains may be leveraged for Phishing, Misinformation, DefamingInformation Disclosure
    4 votes
80. Autocomplete feature
    4 votes
81. UX: JS error on Password Safety linkImproper Authentication - Generic
    4 votes
82. No length limit in invite_code can cause server degradation
    4 votes
83. app.legalrobot.com opens FireFox but not in FireFox ESR
    4 votes
84. Password complexity ignores empty spacesWeak Cryptography for Passwords
    4 votes
85. Account profile shows encryption recovery box for all usersBusiness Logic Errors
    4 votes
86. Rate limiting on Email confirmation linkImproper Authentication - Generic
    4 votes
87. Rate limiting on password reset links Improper Authentication - Generic
    4 votes
88. Non-HTTPS link on blogViolation of Secure Design Principles
    3 votes
89. Token leakage by referrer header & analyticsInformation Disclosure
    3 votes
90. unsecured legalrobot.co.uk assetsViolation of Secure Design Principles
    3 votes
91. Incorrect error messagelow
    2 votes
92. Mixed Content over HTTPS
    2 votes
93. Possible content spoofing due to missing error pageViolation of Secure Design Principles
    2 votes
94. Legal | Application is Missing CSP(Content Security Policy) Header Violation of Secure Design Principles
    2 votes
95. Profile fields validation mismatch
    1 votes