Browse / Starbucks

Starbucks

See its reports on the map

Attack surface: 5,438 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Starbucks

• Cross-site Scripting27
• Access Control18
• Authentication15
• Information Disclosure13
• Cross-Site Request Forgery11
• Insecure Direct Object Reference8

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Starbucks.com is reachable via ip address thus possible to link any doamin to Starbucks.N/ACryptographic Issues - Generic · medium
   9 votes
2. Able to bypass information requirements before launching a Chat.N/AInsecure Direct Object Reference (IDOR) · medium
   6 votes
3. Information Exposure Through an Error Message at news.starbucks.comN/AInformation Exposure Through an Error Message · medium
   5 votes
4. Create New User Whilst Logged OnN/AOpen Redirect
   4 votes
5. Unable to register in starbucks IN appN/AUncontrolled Resource Consumption · low
   3 votes
6. SQL Injection Proof of Concept for Starbucks URLN/ASQL Injection · high
   2 votes
7. Unable to register in starbucks appN/AWeak Cryptography for Passwords · medium
   2 votes