Browse / Starbucks

Starbucks

See its reports on the map

Attack surface: 5,438 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Starbucks

• Cross-site Scripting27
• Access Control18
• Authentication15
• Information Disclosure13
• Cross-Site Request Forgery11
• Insecure Direct Object Reference8

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Password Change not notified when changed from settingsInformativeUnverified Password Change · medium
   7 votes