Security · acknowledgements
The people who found things first.
These researchers responsibly disclosed vulnerabilities to Gish — and made the platform safer for everyone before anyone got hurt. Thank you, all.
47
Reports received
31
Patched
$48k
Paid out
11h
Avg time to triage
2026
Linh N.
@linh.noctura
"IDOR on /api/contributions exposing other users' gift amounts via crafted listIDs"
Anonymous
prefers no credit
"Auth bypass via expired session reuse on the OAuth callback handler"
Tunde A.
@tunde.security
"Stored XSS in wish notes via crafted markdown rendering"
Priya R.
@priyalabs
"CSRF on the friend-removal endpoint — missing token validation"
2025
Marcus W.
@mwebb.dev
"Outcome-fund payee verification could be bypassed for amounts under $500 via timing attack"
Aisha O.
@aisha.haxx
"Privilege escalation in business admin: invited team members briefly received owner-tier permissions"
Dev Patel
@dvpatl
"Browser extension content script could be injected with malicious wish payloads from spoofed retailer pages"
Grace L.
@graceofcode
"Email change verification did not require current password — partial account takeover risk"
Sam Chu
@samchu
"Open redirect in /share?to= parameter could be chained with phishing"
Ines V.
@inesv
"Information disclosure: avatar upload retained EXIF GPS metadata"
2024 · launch year
Jordan K.
@jkdotsec
"Stripe webhook signature validation could be skipped via header manipulation"
Olivia T.
@oliviasec
"Rate limit on password reset endpoint was per-IP not per-account — credential stuffing risk"
Want to be on this list? Find something.
Read the disclosure policy. Email security@gishme.com. We respond fast and pay generously.
Read the policy →