$ cat /disclosures/index
Disclosures
01 published CVE · 29 public acknowledgments
// CVEs
2026
SSRF in OpenProject — OpenProject
LowReporter
Blind SSRF through webhooks and the SMTP test endpoint. Reported independently through the YesWeHack OpenProject program and credited in the advisory. Fixed in v17.2.0.
// Acknowledgments
Companies that have publicly acknowledged my responsible disclosures across bug bounty platforms. Bugcrowd Top 100 (2018) with 400+ reports submitted, 150+ validated across Bugcrowd, YesWeHack, Immunefi, and Google VRP.
Bugcrowd · 17
Mercedes-BenzFireblocks (MPC)ConnectiveRxMastercardDellSophosHubSpotTelefónica GermanyGlobal Fashion GroupOctopusHumble BundleEcommpayNetgearConstant ContactBlueJeans NetworkIndeedBlock Open Source
YesWeHack · 10
Swiss PostOVHCloudDeezerKeycloakBIND 9OpenProjectStashAwaySuperbankNextcloudOhtuleht
Immunefi · 01
Kiln (dApp / Infra)
Google VRP · 01
Google