Reward date
Authentication bypass
HackerOne
Program: Redacted
Improper authentication
- Severity / reported CVSS
- Bounty
- $x,xxx
Public research record
Research acknowledgements.
Disclosure credits, research events, and recognition from our researchers’ public work.
Review the recordsBounty activity
17 findings
Reward date
IDOR / BOLA
HackerOne
Program: Redacted
Broken object-level authorization
- Severity / reported CVSS
- Bounty
- $1,827
Reward date
RXSS
HackerOne
Program: Redacted
- Severity / reported CVSS
- Bounty
- $x,xxx
Reward date
XSS
HackerOne
Program: Redacted
- Severity / reported CVSS
- Bounty
- $431
Reward date
Information disclosure
HackerOne
Program: Redacted
Exposure of sensitive information
- Severity / reported CVSS
- Bounty
- $x,xxx
Reward date
Authentication bypass
HackerOne
Program: Redacted
Improper authentication
- Severity / reported CVSS
- Bounty
- $7,500
Reward date
XSS
HackerOne
Program: Redacted
- Severity / reported CVSS
- Bounty
- $x,xxx
Reward date
RXSS
Zerocopter
Program: Redacted
- Severity / reported CVSS
- Bounty
- €200
Reward date
Improper authentication
HackerOne
Program: Redacted
Improper Authentication - Generic
- Severity / reported CVSS
- Bounty
- $1,877
Reward date
Uncontrolled Resource Consumption
HackerOne
Program: Slack
Uncontrolled Resource Consumption
- Severity / reported CVSS
- Bounty
- $500
Report date
Subdomain takeover
Bugcrowd
Program: Redacted
Misconfigured DNS
- Severity
- Bounty
- $500
Reward date
XML external entity injection
Zerocopter
Program: Redacted
Improper restriction of XML external entities
- Severity
- Bounty
- €500
Reward date
Unauthenticated impersonation
Zerocopter
Program: Redacted
Improper authentication
- Severity
- Bounty
- €1,000
Reward date
Server-side request forgery
Zerocopter
Program: Redacted
Unrestricted server-side requests
- Severity
- Bounty
- €500
Reward date
SQL injection
Zerocopter
Program: Redacted
Improper SQL query handling
- Severity / reported CVSS
- Bounty
- €x,xxx
Report date
Broken access control
Intigriti
Program: Redacted
Missing authentication for sensitive records
- Severity
- Bounty
- $x,xxx
Reward date
Broken access control
HackerOne
Program: Redacted
Missing authentication for a critical function
- Severity / reported CVSS
- Bounty
- $2,789
Grid view. 17 findings shown.
From responsible disclosure programs
The conversation after the finding.
Program feedback on analyz3r’s vulnerability submissions. Open each original screenshot to read it in context.
OZ Forensics
@analyz3r exemplifies what responsible disclosure should look like: clear reporting, professional communication, and a collaborative attitude that made same-day triage and remediation possible. Highly recommended researcher.
Read original feedback
Open full-size evidence GoCardless
@analyz3r has found multiple flaws and helped us prevent significant downtime and loss of revenue. They provided well-written reports, good evidence, and maintained professional, helpful communication throughout triage and remediation. They set a good example of skill and behaviour for public security researchers.
Read original feedback
Open full-size evidence Poll Everywhere
@analyz3r is one of the most methodical testers we have ever worked with, with a deep understanding of complex systems. They understand the security implications of different security models and how they combine to create larger, more devastating flaws. We definitely recommend @analyz3r!
Read original feedback
Open full-size evidence Disclosure acknowledgements
Credits and hall-of-fame records connected to responsible vulnerability disclosure.
T mobile
HoFtelekom hall of fame
2022mosec
PayPal
HoFPayPal Bug Bounty
2021mosec
Slack
HoFSlack Bug Bounty
2023sirat
U.S. Department of Defense
HoFDoD Vulnerability Disclosure Program
2023sirat
Live research events
Public events in which team researchers participated.
Other public recognition
Additional published recognition of security research activity.
Jumpseller
CreditJumpseller
2021mosec
Sony
CreditSony Security Researcher
2020sirat
Read the underlying work