Reports in gratipay program: S.No Title Bounty 1 upgrade Aspen on inside.gratipay.com to pick up CR injection fix $40.0 2 Send email asynchronously $10.0 3 Prevent content spoofing on /~username/emails/verify.html $10.0 4 bring grtp.co up to A grade on SSLLabs $1.0 5 Avoid "resend verification email" confusion $1.0 6 limit number of images in statement $1.0 7 csrf_token cookie don't have the flag "HttpOnly" $0.0 8 fix bug in username restriction $0.0 9 Cross Site Scripting In Profile Statement $0.0 10 auto-logout after 20 minutes $0.0 11 Reset Link Issue $0.0 12 XSS Via Method injection $0.0 13 CSRF csrftoken in cookies $0.0 14 Gratipay uses the random module's cryptographically insecure PRNG. $0.0 15 User Enumeration $0.0 16 Content type incorrectly stated $0.0 17 Cookie HttpOnly Flag Not Set $0.0 18 Certificate signed using SHA-1 $0.0 19 Secure Pages Include Mixed Content $0.0 20 Session Fixation At Logout /Session Misconfiguration $0.0 21 Username Restriction is not applied for reserved folders $0.0 22 Username can be used to trick the victim on the name of www.gratipay.com $0.0 23 URL Given leading to end users ending up in malicious sites $0.0 24 Incomplete or No Cache-control and Pragma HTTP Header Set $0.0 25 Limit email address length $0.0 26 Content-Length restriction bypass to heap overflow in gip.rocks. $0.0 27 HTTP trace method is enabled on aspen.io $0.0 28 Content length restriction bypass can lead to DOS by reading large files on gip.rocks $0.0 29 Inadequate/dangerous jQuery behavior $0.0 30 HTTP trace method is enabled on gip.rocks $0.0 31 Transferring incorrect data to the http://gip.rocks/v1 endpoint with correct Content-Type leads to local paths disclosure through the error message $0.0 32 POODLE SSLv3.0 $0.0 33 Harden resend throttling $0.0 34 Unauthorized access to the slack channel via inside.gratipay.com/appendices/chat $0.0 35 nginx version disclosure on downloads.gratipay.com $0.0 36 Gratipay Website CSP "script-scr" includes "unsafe-inline" $0.0 37 change bank account numbers $0.0 38 X-Content-Type Header Missing For aspen.io $0.0 39 Email Spoofing $0.0 40 CSP Policy Bypass and javascript execution $0.0 41 CSP Policy Bypass and javascript execution Still Not Fixed $0.0 42 Possible user session hijack by invalid HTTPS certificate on inside.gratipay.com domain $0.0 43 Possible User Session Hijack using Invalid HTTPS certificate on inside.gratipay.com domain $0.0 44 self cross site scripting $0.0 45 Insecure Transportation Security Protocol Supported (TLS 1.0) $0.0 46 SSl Weak Ciphers $0.0 47 prevent content spoofing on /~username/emails/verify.html $0.0 48 CSP "script-src" includes "unsafe-inline" in https://gratipay.com $0.0 49 Lack of CSRF token validation at server side $0.0 50 x-xss protection header is not set in response header $0.0 51 Usernames ending in .json are not restricted $0.0 52 SQL TEST $0.0 53 This is a test report $0.0 54 Sub domain take over in gratipay.com $0.0 55 SPF Protection not used, I can hijack your email server $0.0 56 Directory Listing on grtp.co $0.0 57 Submit a non valid syntax email $0.0 58 Markdown parsing issue enables insertion of malicious tags $0.0 59 Possible Blind SQL injection | Language choice in presentation $0.0 60 Login csrf. $0.0 61 PHP 5.4.45 is Outdated and Full of Preformance Interupting Arbitrary Code Execution Bugs $0.0 62 prevent %2f spoofed URLs in profile statement $0.0 63 set Expires header $0.0 64 don't leak Server version for assets.gratipay.com $0.0 65 [gratipay.com] Cross Site Tracing $0.0 66 Host Header poisoning on gratipay.com $0.0 67 After removing app from facebook app session not expiring. $0.0 68 xss $0.0 69 Gratipay rails secret token (secret_key_base) publicly exposed in GitHub $0.0 70 clickjacking on https://gratipay.com/on/npm/[text] $0.0 71 400 Bad Request [Use a third-party provider to sign in or create an account on Gratipay] $0.0 72 Information Disclosure on inside.gratipay.com $0.0 73 Show hide privacy giving receiving on my website $0.0 74 Missing Certificate Authority Authorization rule $0.0 75 Missing Certificate Authority Authorization rule $0.0 76 set Pragma header $0.0 77 Reflected XSS - gratipay.com $0.0 78 protect against tabnabbing in statement $0.0 79 XSS found In Your Web $0.0 80 Adding Used Primary Email Address to attacker account and Account takeover $0.0 81 Broken link for stale DNS entry may be leveraged for Phishing, Misinformation, Serving Malware $0.0 82 Sub Domain Takeover $0.0 83 Bypassing X-frame options $0.0 84 i am The bug $0.0 85 Reflected SQL Execution $0.0 86 Application-level DoS on image's "size" parameter. $0.0 87 Saying goodbye to HackerOne and Gratipay. $0.0 88 CSV injection in gratipay.com via payment history export feature. $0.0