Browse / Liberapay

Liberapay

See its reports on the map

Attack surface: 36 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Liberapay

• Information Disclosure8
• Authentication7
• Misconfiguration7
• Cross-Site Request Forgery6
• Business Logic6
• Access Control4

Most upvoted reports

AllValidInformativeN/ADuplicate

1. another liberapay member team twitter account broken Link Hijacking via Expired Twitter Account LinkInformativeOpen Redirect
   77 votes
2. Password Reset Token Leak Via ReferrerInformativeInformation Disclosure · medium
   42 votes
3. Disavowed an email without any authenticationInformativeImproper Access Control - Generic · medium
   24 votes
4. Leaking Of Sensitive Information on GithubInformativeInformation Disclosure · low
   17 votes
5. Full Path disclosure on 500 errorInformativeInformation Disclosure · low
   11 votes
6. User Enumeration InformativeInformation Disclosure · low
   9 votes
7. Liberapay Non Verified Account Takeover with signup featureInformativeImproper Authentication - Generic
   8 votes
8. csrf token did not changed after login/logout many timesInformativeCross-Site Request Forgery (CSRF)
   8 votes
9. Able to View other users income historyInformativeInsecure Direct Object Reference (IDOR)
   7 votes
10. Insecure Account DeletionInformativeImproper Authentication - Generic
    6 votes
11. Disavowing an account doesn't disable itInformativeImproper Authentication - Generic · low
    5 votes
12. CSRF to make any user accept the invitation to the teamInformativeCross-Site Request Forgery (CSRF)
    5 votes
13. CSRF token manipulation in every possible form submits. NO server side ValidationInformativeCross-Site Request Forgery (CSRF)
    3 votes
14. CSRF ON EDITING NAME (OPTIONAL)InformativeCross-Site Request Forgery (CSRF)
    3 votes
15. Same CSRF token is being used for deleting other platform login’s within an account and across other liberapay Account’sInformativeCross-Site Request Forgery (CSRF)
    3 votes
16. Session Cookie without HttpOnly and secure flag setInformativeViolation of Secure Design Principles
    2 votes
17. A single user can subscribe a community multiple timesInformativeBusiness Logic Errors
    2 votes
18. REGISTRATION USING FAKE EMAIL ACCOUNTInformativeBusiness Logic Errors
    2 votes
19. No Data Validation, No Captcha, No Filters...InformativeBusiness Logic Errors
    1 votes
20. Punny code Detection Parsing should be implemented on Markdown InformativeBusiness Logic Errors
    1 votes
21. Phishing by Navigating Browser TabsInformativeViolation of Secure Design Principles
    1 votes
22. Current CSP Policy chained with HTML Injection can lead to Data ExfiltrationInformativeViolation of Secure Design Principles
    1 votes