$ cat /disclosures/index
Disclosures
01 published CVE · 29 public acknowledgments
# CVEs
2026
SSRF in OpenProject — OpenProject
MediumReporter
Server-Side Request Forgery in OpenProject. Coordinated disclosure with the OpenProject security team; fix merged upstream in v17.2.0.
# Acknowledgments
Companies that have publicly acknowledged my responsible disclosures across bug bounty platforms. Bugcrowd Top 100 (2018) with 400+ reports submitted, 150+ validated across Bugcrowd, YesWeHack, Immunefi, Intigriti, and Synack Red Team.
Bugcrowd · 17
Mercedes-BenzFireblocks (MPC)ConnectiveRxMastercardDellSophosHubSpotTelefónica GermanyGlobal Fashion GroupOctopusHumble BundleEcommpayNetgearConstant ContactBlueJeans NetworkIndeedBlock Open Source
YesWeHack · 10
Swiss PostOVHCloudDeezerKeycloakBIND 9OpenProjectStashAwaySuperbankNextcloudOhtuleht
Immunefi · 01
Kiln (dApp / Infra)
Google VRP · 01
Google