SecureBananaLabs

SecureBananaLabs/bug-bounty

228 stars 745 forks 228 watchers JavaScript
View on GitHub
60 Open Issues Need Help Last updated: Jul 1, 2026

Open Issues Need Help

View All on GitHub
CORS configured without origin allowlist in app.js (reissue via #743) about 9 hours ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $780
SecureBananaLabs/bug-bounty
228

JavaScript
Low Handing Fruit Automation 4 days ago
bug documentation good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $700
SecureBananaLabs/bug-bounty
228

JavaScript
Benchmark APIs with p50, p95, p99 latency, RPS, error rate and TTFB 4 days ago
good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $750
SecureBananaLabs/bug-bounty
228

JavaScript
Pixel Art Creation with high Creative Thinking 4 days ago
good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $780
SecureBananaLabs/bug-bounty
228

JavaScript
Automate Bug Detection and Reviews 4 days ago
bug documentation enhancement good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $780 $1k $1.2k
SecureBananaLabs/bug-bounty
228

JavaScript
Job validation should reject inverted budget ranges 4 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
upload endpoint accepts empty file submissions as successful uploads 4 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $780
SecureBananaLabs/bug-bounty
228

JavaScript
Implement a fully functional Admin Panel 13 days ago
good first issue bug bounty AI agent friendly bounty 💎 Bounty $1k $1
SecureBananaLabs/bug-bounty
228

JavaScript
POST /api/reviews endpoint missing authentication middleware (reissue via #743) 17 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $780
SecureBananaLabs/bug-bounty
228

JavaScript
registerUser access token can reference a different user id 17 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $780
SecureBananaLabs/bug-bounty
228

JavaScript
Technical Poem Generation and Content Creation 18 days ago
good first issue bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
auth refresh endpoint issues tokens without verifying the requester 19 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $780
SecureBananaLabs/bug-bounty
228

JavaScript
User creation endpoint has no input validation 19 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
Calculate the exact value of PI #2872 26 days ago
bug documentation good first issue help wanted bug bounty AI agent friendly bounty $1.2k
SecureBananaLabs/bug-bounty
228

JavaScript
Calculate the exact value of PI 26 days ago
bug documentation good first issue help wanted bug bounty AI agent friendly bounty $1.2k
SecureBananaLabs/bug-bounty
228

JavaScript
Implement Secure Payment Gateway and Payment Service 26 days ago
bug good first issue bug bounty AI agent friendly bounty 💎 Bounty $350
SecureBananaLabs/bug-bounty
228

JavaScript
Bug: Missing admin role authorization check on admin metrics endpoint 26 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
Bug: Proposal creation accepts records missing estimated duration 26 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
Upload endpoint lacks authentication — unauthenticated file uploads allowed 26 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
Registration token subject can drift from returned user id 26 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
fix: prevent admin role self-assignment during registration 26 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
Bug: Refresh endpoint mints tokens without validating a refresh token 26 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
fix(auth): prevent admin role self-assignment during registration 26 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
Bug: Multiple security vulnerabilities in API layer - registerUser() ID mismatch, missing auth, missing validation 26 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
fix: prevent admin role self-assignment 26 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
Admin routes lack role-based access control — any authenticated user can access admin endpoints 26 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
Payment endpoint lacks authentication — unauthenticated payment creation 26 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
Bug: user creation accepts empty payloads and client-controlled ids 26 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
Bug: registerUser signs token with a different generated user id 26 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
Bug: Rate limiter should count malformed JSON before body parsing 26 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
fix: prevent admin role self-assignment 26 days ago
bug documentation good first issue bug bounty AI agent friendly bounty 💎 Bounty $700
SecureBananaLabs/bug-bounty
228

JavaScript
POST /api/users endpoint missing authentication middleware (reissue via #743) 26 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $780
SecureBananaLabs/bug-bounty
228

JavaScript
POST /api/proposals endpoint missing authentication middleware (reissue via #743) 26 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $780
SecureBananaLabs/bug-bounty
228

JavaScript
Registration should require fullName to match User model 29 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
@freelanceflow/db package should expose an importable workspace entrypoint 29 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Job creation endpoint lacks authentication — anyone can post jobs about 2 months ago
bug good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Freelancer profile route should resolve mock profiles by username about 2 months ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Search endpoint has no input validation or length limit on query about 2 months ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Reject inverted job budget ranges in job validation 2 months ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Reject inverted job budget ranges in job validation 2 months ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Refresh token endpoint ignores the provided refresh token 3 months ago
bug good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
@freelanceflow/ui package entrypoint should be directly importable (reissue via #743) 3 months ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Notification creation should preserve server-owned id and read state 3 months ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Payment API should require authentication 3 months ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
fix: prevent admin role self-assignment during registration 3 months ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
fix: enforce authentication on job creation endpoint 3 months ago
bug good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Search endpoint has no input validation or length limit on query 3 months ago
bug good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
CORS configured with no origin restrictions — allows any domain 3 months ago
bug good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Patch PostCSS audit advisory from Next dependency lockfile 3 months ago
bug good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
fix: prevent DoS on search endpoint via query length limit and input validation 3 months ago
bug good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Settings page should provide actionable account controls 3 months ago
bug good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Settings page should provide actionable account controls 3 months ago
bug good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Bug: Admin role self-assignment via registration endpoint 3 months ago
bug good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Job detail page should render matching mock job and unknown fallback 3 months ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Job detail route should resolve mock jobs by id 3 months ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Freelancer profile should render matching mock profile and unknown fallback 3 months ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Registration token subject should match returned user id 3 months ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
@freelanceflow/ui package entrypoint should be directly importable 3 months ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Job detail route should resolve mock jobs by id (reissue via #743) 3 months ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Settings page should provide actionable account controls 3 months ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript