netrc credentials leaked to a cross-host redirect target on the Basic auth path (not covered by redirect credential protections)
HackerOnecurl2026-10-26
Web
Medium
BUG BOUNTY WRITEUPS
Exposed secrets and API keys writeups
Hardcoded keys, leaked tokens and credentials sitting in JavaScript bundles, apps and public repositories.
49 reports and writeups from 2024 to 2026. 32 carry a severity from the disclosing platform, 11 of them rated High or Critical. Last updated 2026-10-30.
Latest Exposed secrets and API keys reports
Search and filter all writeupsA disabled account's API key still works on BMO's Mojolicious /rest/ routes, including for security-group bugs filed after the disable
HackerOneMozilla2026-10-26$4,000 bounty
Web, API
High
TATA Group Security Research Discovering a Hardcoded AES Key
Medium2026-10-17
Web
Not rated
Background sync cache retains outgoing additional transaction secret keys
HackerOneMonero2026-08-20
Web3
Low
bedrock-mantle.api.aws accepts Bedrock API keys outside the IAM Deny, CloudTrail signal, and invocation logging AWS publishes for Bedrock keys
HackerOneAWS VDP2026-07-14
Web, API, Cloud
Medium
Proxy credentials leaked in ERR_PROXY_TUNNEL error message
HackerOneNode.js2026-06-25
Web
Medium
CVE-2026-6253: proxy credentials leak over redirect-to proxy
HackerOnecurl2026-04-29
Web
Medium
CVE-2026-6429: netrc credential leak with reused proxy connection
HackerOnecurl2026-04-29
Web
Medium
Bearer Token Leaked to Attacker via .netrc Despite CVE-2026-3783 Fix
HackerOnecurl2026-03-26
Web
Not rated
CVE-2026-3783: token leak with redirect and netrc
HackerOnecurl2026-03-11
Web
Medium
CVE-2025-14524: bearer token leak on cross-protocol redirect
HackerOnecurl2026-01-07
Web
Low
Alt-Svc bypasses credential leak protection (CVE-2018-1000007)
HackerOnecurl2026-01-04
Web
High
elections.k8s.io uses weak session secret key, may place elections at risk
HackerOneKubernetes2025-09-19$250 bounty
Web, Cloud
High
Stored XSS on TikTok's backend leads to the leakage of highly sensitive administrator data (Cookies, API Keys, Internal Paths, Emails, phone numbers).
HackerOneTikTok2025-09-11
Web, API
Medium
█.8x8.vc/index.js: Exposed Google Maps API Key Allowing Potential Abuse of Paid Services
HackerOne8x82025-08-14$500 bounty
Web, API
Medium
API Key Exposed in JavaScript File on 1Password Developer Site
HackerOne1Password - Enterprise Password Manager2025-07-18
Web, API
Not rated
Banned user still has access to their deleted account via HackerOne's API using their API key
HackerOneHackerOne2025-07-14
Web, API
Medium
Credential leak on redirect due to improper state clearing when parsing macdef in netrc.c
HackerOnecurl2025-06-22
Web
Low
IDOR on in-app hardcoded zombie endpoint
HackerOneBykea2025-06-13
Web, API
Medium
user api key leaked
HackerOneWakaTime2025-05-13
Web, API
Not rated
Sensitive API Key Leakage
HackerOneAWS VDP2025-03-04
Web, API, Cloud
Medium
CVE-2025-0167: netrc and default credential leak
HackerOnecurl2025-02-07
Web
Low
netrc and redirect credential leak
HackerOneInternet Bug Bounty2025-01-15$505 bounty
Web
Low
CVE-2024-11053: netrc + redirect credential leak
HackerOnecurl2024-12-11
Web
Low
paypal client_id And stripe api key indexed on web archive
HackerOneMozilla2024-10-18
Web, API
Not rated
two aws access key and secret key and database username and password exposed
HackerOneMozilla2024-10-18
Web, Cloud
Critical
User API Key leakage in Github commit leads to unauthorized access to sql.telemetry.mozilla.org
HackerOneMozilla2024-10-08
Web, API
High
Sauce Labs API key unencrypted in an old commit
HackerOneRuby on Rails2024-10-08
Web, API
Medium
SSRF and secret key disclosure found on Turbonomic endpoint
HackerOneIBM2024-09-19
Web, API
High
SSRF and secret key disclosure found on Turbonomic endpoint
HackerOneIBM2024-09-19
Web, API
High
[Monero wallet RPC] File precreation to file ownership and credentials leak
HackerOneMonero2024-09-04
Web3
Not rated
Credentials leaked via Github
HackerOneAcronis2024-08-26$50 bounty
Web
Medium
Living off the VPN — Exploring VPN Post-Exploitation Techniques
Researcher blogIvanti (Connect Secure), Fortinet (Fortigate VPN)2024-08-07
Web
Not rated
https://srcds.valve.net/find/ is leaking server config / API keys
HackerOneValve2024-08-06
Web, API
High
/applications/dpc_(get|post) provide full access to api.steampowered.com with the Dota2 API key
HackerOneValve2024-07-30
Web, API
High
Hacking a Secure Industrial Remote Access Gateway
Researcher blogHMS (Ewon Cosy+)2024-07-12
Web
Not rated
Local File Disclosure on the █████ (https://████████.edu/) leads to the full source code disclosure and credentials leak
HackerOneU.S. Dept Of Defense2024-06-27
Web, Source Code
Critical
20 Security Issues Found in Xiaomi Devices
Researcher blogXiaomi2024-05-02
Android, Source Code, Binary
Not rated
BlackBerry MDM Has Some Authentication Flaws
GitHubBlackBerry2024-04-22
API, Android
Not rated
How i Manage to Get Sensitive Informations via docker image
MediumGlobe Telecom (Gcash)2024-04-18
Web, Cloud
Not rated
PATCH method manipulation allowing the users to escalate their functionalities and edit (upgrade/downgrade) API Keys settings which is not allowed
HackerOneFrontegg2024-03-20
Web, API
Low
Web
Not rated
Non-revoked API Key Disclosure in a Disclosed API Key Disclosure Report on Stripo
HackerOneStripo Inc2024-02-15
Web, API
Medium
ALWAYS test 404 Not Found in Bug Bounties!
Medium2024-02-06
Web
Not rated
Datadog api keys exposed can be used to do all the read and write access to the instance
HackerOneMars2024-01-25
Web, API
Critical
Shipping your Private Key - CVE-2023-43870, Paxton do a Lenovo
Researcher blogPaxton2024-01-25
Web
Not rated
XSS to OAuth access token leak in office online which can be used to account takeover
GitHubMicrosoft2024-01-12$500 bounty
Web
Not rated
Exploiting Hardcoded Keys to achieve RCE in Yellowfin BI
Researcher blog2024-01-03
Web
Not rated
Web, API
Not rated
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.