Browse / Starbucks

Starbucks

See its reports on the map

Attack surface: 5,438 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Starbucks

• Cross-site Scripting27
• Access Control18
• Authentication15
• Information Disclosure13
• Cross-Site Request Forgery11
• Insecure Direct Object Reference8

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Missing CSRF Token On Remove Coupun From CartDuplicateCross-Site Request Forgery (CSRF) · low
   10 votes
2. Missing CSRF Token On Add Coupon To BasketDuplicateCross-Site Request Forgery (CSRF) · low
   8 votes
3. csrf blogs.starbucks.comDuplicateCross-Site Request Forgery (CSRF)
   5 votes