November 2, 2026
The Impact Section Is One Word. The Bounty Is $25,000.
“SSRF.” was not minimalism. It was the endpoint of complete work.
By Raj Namdev
7 min read
30-second version:_ HackerOne report #2262382 was filed against HackerOne's own platform. It carries a $25,000 bounty, a CVSS 10.0 scored by HackerOne's own team, and 529 upvotes — and its public impact section is one word:_ "SSRF." I pulled the report's JSON, the team's disclosure summary, and the researcher's conclusion to reconstruct what actually happened: an iframe inside a PDF export, internal AWS credentials left untouched, and a fix in under a day.
⚠️ Verification note: HackerOne's report page loaded this session but truncated before most structured fields (bounty, CVSS, upvotes, the full quotes). I found an independent secondary write-up (a Medium-sourced summary, not HackerOne itself) that corroborates the $25,000 bounty and the November 23, 2023 filing date, and describes the same Analytics Reports feature — but it lists the severity as 9.8, not the 10.0 your draft states. That's a real discrepancy I can't resolve from here: it may be that source's own scoring rather than HackerOne's official CVSS, or your 10.0 may be the accurate HackerOne-assigned number. Worth a direct re-check against the live report before publishing. Everything else report-specific (529 upvotes, the exact quotes, the December 8 disclosure date) is carried over from your original…