Owner

SecureBananaLabs

1 indexed repository · View on GitHub

bug-bounty

JavaScript · 297 stars

Beginner friendly Everything

Open All

Fix: Test runner script passes a directory path instead of a glob to node --test (ref #743) Open

Difficulty 1/5 Under an hour Newbie friendliness 20/100

SecureBananaLabs/bug-bounty#12666 · Opened Sep 19, 2026
Bug: CORS configured without restricting HTTP methods Open

Difficulty 1/5 Under an hour Newbie friendliness 85/100

SecureBananaLabs/bug-bounty#12625 · Opened Sep 17, 2026
Bug: No request ID middleware for traceability Open

Difficulty 3/5 1-2 days Newbie friendliness 55/100

SecureBananaLabs/bug-bounty#12623 · Opened Sep 17, 2026
Bug: No readiness/health check endpoint for container orchestration Open

Difficulty 3/5 1-2 days Newbie friendliness 64/100

SecureBananaLabs/bug-bounty#12621 · Opened Sep 17, 2026
Bug: Server has no graceful shutdown handler Open

Difficulty 3/5 1-2 days Newbie friendliness 65/100

SecureBananaLabs/bug-bounty#12619 · 1 comment · Opened Sep 17, 2026
Bug: PORT environment variable may be parsed incorrectly Open

Difficulty 1/5 Under an hour Newbie friendliness 88/100

SecureBananaLabs/bug-bounty#12617 · 1 comment · Opened Sep 17, 2026
Fix: User creation should ignore client-supplied id Open

Difficulty 2/5 1-3 hours Newbie friendliness 25/100

SecureBananaLabs/bug-bounty#12615 · Opened Sep 17, 2026
Fix: User creation endpoint has no input validation Open

Difficulty 3/5 1-2 days Newbie friendliness 20/100

SecureBananaLabs/bug-bounty#12613 · Opened Sep 17, 2026
Fix: Patch PostCSS audit advisory from Next dependency lockfile Open

Difficulty 2/5 1-3 hours Newbie friendliness 25/100

SecureBananaLabs/bug-bounty#12611 · Opened Sep 17, 2026
Fix: Enforce authentication on job creation endpoint Open

Difficulty 2/5 1-3 hours Newbie friendliness 25/100

SecureBananaLabs/bug-bounty#12609 · Opened Sep 17, 2026
Fix: @freelanceflow/db package should expose an importable workspace entrypoint Open

Difficulty 2/5 1-3 hours Newbie friendliness 25/100

SecureBananaLabs/bug-bounty#12607 · Opened Sep 17, 2026
Fix: @freelanceflow/ui package entrypoint should be directly importable Open

Difficulty 2/5 1-3 hours Newbie friendliness 20/100

SecureBananaLabs/bug-bounty#12605 · Opened Sep 17, 2026
Fix: Job detail route should resolve mock jobs by id Open

Difficulty 2/5 1-3 hours Newbie friendliness 25/100

SecureBananaLabs/bug-bounty#12603 · Opened Sep 17, 2026
Fix: Notification creation should preserve server-owned id and read state Open

Difficulty 2/5 1-3 hours Newbie friendliness 25/100

SecureBananaLabs/bug-bounty#12601 · Opened Sep 17, 2026
Fix: Registration should require fullName to match User model Open

Difficulty 4/5 3-5 days Newbie friendliness 20/100

SecureBananaLabs/bug-bounty#12599 · Opened Sep 17, 2026
Fix: Add input validation to search endpoint Open

Difficulty 2/5 1-3 hours Newbie friendliness 20/100

SecureBananaLabs/bug-bounty#12597 · Opened Sep 17, 2026
Bug: admin routes accept client role — missing role-based access control Open

Difficulty 2/5 1-3 hours Newbie friendliness 25/100

SecureBananaLabs/bug-bounty#12595 · Opened Sep 17, 2026
Bug: GET /api/users exposes all user data to any authenticated user Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

SecureBananaLabs/bug-bounty#12593 · Opened Sep 17, 2026
Bug: Notification endpoint allows creating notifications for any user Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

SecureBananaLabs/bug-bounty#12591 · Opened Sep 17, 2026
Bug: Payment endpoint allows creating payments for any user Open

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

SecureBananaLabs/bug-bounty#12589 · Opened Sep 17, 2026
Bug: Proposal endpoint allows creating proposals as any freelancer Open

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

SecureBananaLabs/bug-bounty#12587 · Opened Sep 17, 2026
Bug: Message endpoint allows sending messages as any user Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

SecureBananaLabs/bug-bounty#12585 · Opened Sep 17, 2026
Bug: Review endpoint allows any user to create reviews for any freelancer Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

SecureBananaLabs/bug-bounty#12583 · Opened Sep 17, 2026
Bug: Login endpoint does not verify user password Open

Difficulty 2/5 1-3 hours Newbie friendliness 86/100

SecureBananaLabs/bug-bounty#12581 · Opened Sep 17, 2026
Bug: Admin routes only check authentication, not role-based access control Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

SecureBananaLabs/bug-bounty#12579 · Opened Sep 17, 2026
Bug: @freelanceflow/ui package has no importable workspace entrypoint Open

Difficulty 1/5 Under an hour Newbie friendliness 88/100

SecureBananaLabs/bug-bounty#12577 · Opened Sep 17, 2026
Bug: @freelanceflow/db package has no importable workspace entrypoint Open

Difficulty 1/5 Under an hour Newbie friendliness 88/100

SecureBananaLabs/bug-bounty#12575 · Opened Sep 17, 2026
Bug: POST /api/auth/refresh and GET /api/auth/oauth/:provider/callback lack authentication Open

Difficulty 3/5 1-2 days Newbie friendliness 48/100

SecureBananaLabs/bug-bounty#12573 · Opened Sep 17, 2026
Bug: Search endpoint always returns empty results Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

SecureBananaLabs/bug-bounty#12571 · 1 comment · Opened Sep 17, 2026
Bug: Admin metrics endpoint returns hardcoded fake data Open

Difficulty 1/5 Under an hour Newbie friendliness 88/100

SecureBananaLabs/bug-bounty#12569 · Opened Sep 17, 2026
Bug: No request logging middleware configured Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

SecureBananaLabs/bug-bounty#12567 · Opened Sep 17, 2026
Bug: Helmet configured without Content-Security-Policy Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

SecureBananaLabs/bug-bounty#12565 · Opened Sep 17, 2026
Bug: User creation allows arbitrary fields via mass assignment Open

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

SecureBananaLabs/bug-bounty#12561 · Opened Sep 17, 2026
Bug: Auth routes lack strict rate limiting Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

SecureBananaLabs/bug-bounty#12560 · Opened Sep 17, 2026
Bug: Job creation accepts inverted budget ranges Open

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

SecureBananaLabs/bug-bounty#12559 · Opened Sep 17, 2026
Bug: POST /api/payments accepts arbitrary body without input validation Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

SecureBananaLabs/bug-bounty#12550 · Opened Sep 17, 2026
Bug: POST /api/reviews accepts arbitrary body without input validation Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

SecureBananaLabs/bug-bounty#12549 · Opened Sep 17, 2026
Bug: POST /api/messages accepts arbitrary body without input validation Open

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

SecureBananaLabs/bug-bounty#12548 · Opened Sep 17, 2026
Bug: POST /api/users accepts arbitrary body without input validation Open

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

SecureBananaLabs/bug-bounty#12547 · Opened Sep 17, 2026
Bug: POST /api/notifications accepts arbitrary body without input validation Open

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

SecureBananaLabs/bug-bounty#12546 · Opened Sep 17, 2026
Bug: POST /api/proposals accepts arbitrary body without input validation Open

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

SecureBananaLabs/bug-bounty#12545 · Opened Sep 17, 2026
Bug: GET /api/search has no length limit on query parameter - DoS vector Open

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

SecureBananaLabs/bug-bounty#12544 · Opened Sep 17, 2026
Bug: POST /api/uploads accepts empty file submissions as successful Open

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

SecureBananaLabs/bug-bounty#12543 · Opened Sep 17, 2026
Bug: job routes missing auth middleware — unauthenticated job creation Open

Difficulty 2/5 1-3 hours Newbie friendliness 25/100

SecureBananaLabs/bug-bounty#12540 · Opened Sep 17, 2026
Bug: upload routes missing auth middleware — unauthenticated file upload Open

Difficulty 2/5 1-3 hours Newbie friendliness 15/100

SecureBananaLabs/bug-bounty#12539 · Opened Sep 17, 2026
Bug: search routes missing auth middleware — unauthenticated data search Open

Difficulty 1/5 Under an hour Newbie friendliness 25/100

SecureBananaLabs/bug-bounty#12535 · Opened Sep 17, 2026
Bug: notification routes missing auth middleware — all notifications exposed Open

Difficulty 1/5 Under an hour Newbie friendliness 20/100

SecureBananaLabs/bug-bounty#12534 · Opened Sep 17, 2026
Bug: payment routes missing auth middleware — unauthenticated payment creation Open

Difficulty 2/5 1-3 hours Newbie friendliness 35/100

SecureBananaLabs/bug-bounty#12533 · Opened Sep 17, 2026
Bug: review routes allow editing/deleting other users' reviews Open

Difficulty 2/5 1-3 hours Newbie friendliness 20/100

SecureBananaLabs/bug-bounty#12529 · Opened Sep 17, 2026
Bug: message routes expose all conversations to any authenticated user Open

Difficulty 3/5 1-2 days Newbie friendliness 20/100

SecureBananaLabs/bug-bounty#12528 · Opened Sep 17, 2026

Showing the newest 100

This page lists what was indexed most recently. Advanced filter has the whole inventory, narrowed by language, difficulty and how long a task takes.

Open advanced filter

SecureBananaLabs

Showing the newest 100

Get new issues in your inbox