SecureBananaLabs

SecureBananaLabs/bug-bounty

228 stars 745 forks 228 watchers JavaScript
View on GitHub
59 Open Issues Need Help Last updated: Jul 1, 2026

Open Issues Need Help

View All on GitHub
Low Handing Fruit Automation about 7 hours ago
bug documentation good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $700
SecureBananaLabs/bug-bounty
228

JavaScript
Pixel Art Creation with high Creative Thinking about 13 hours ago
good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $780
SecureBananaLabs/bug-bounty
228

JavaScript
Admin routes lack role-based access control — any authenticated user can access admin endpoints about 14 hours ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
User creation endpoint has no input validation about 14 hours ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
Upload endpoint lacks authentication — unauthenticated file uploads allowed about 16 hours ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
fix: prevent admin role self-assignment during registration about 19 hours ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
fix: enforce authentication on job creation endpoint about 20 hours ago
bug good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
fix: prevent admin role self-assignment about 20 hours ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
fix: prevent admin role self-assignment during registration about 20 hours ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
fix: prevent admin role self-assignment 1 day ago
bug documentation good first issue bug bounty AI agent friendly bounty 💎 Bounty $700
SecureBananaLabs/bug-bounty
228

JavaScript
Bug: Refresh endpoint mints tokens without validating a refresh token 1 day ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
Benchmark APIs with p50, p95, p99 latency, RPS, error rate and TTFB 1 day ago
good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $750
SecureBananaLabs/bug-bounty
228

JavaScript
Technical Poem Generation and Content Creation 1 day ago
good first issue bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
Bug: Multiple security vulnerabilities in API layer - registerUser() ID mismatch, missing auth, missing validation 5 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
Implement Secure Payment Gateway and Payment Service 5 days ago
bug good first issue bug bounty AI agent friendly bounty 💎 Bounty $350
SecureBananaLabs/bug-bounty
228

JavaScript
Job validation should reject inverted budget ranges 8 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Search endpoint has no input validation or length limit on query 9 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
CORS configured with no origin restrictions — allows any domain 12 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Refresh token endpoint ignores the provided refresh token 12 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Job creation endpoint lacks authentication — anyone can post jobs 12 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Patch PostCSS audit advisory from Next dependency lockfile 12 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
fix: prevent DoS on search endpoint via query length limit and input validation 12 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Settings page should provide actionable account controls 12 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Settings page should provide actionable account controls 12 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Bug: Admin role self-assignment via registration endpoint 12 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Job detail page should render matching mock job and unknown fallback 12 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Payment API should require authentication 12 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Job detail route should resolve mock jobs by id 12 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Notification creation should preserve server-owned id and read state 12 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Freelancer profile should render matching mock profile and unknown fallback 12 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Registration token subject should match returned user id 12 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Registration should require fullName to match User model 12 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
@freelanceflow/db package should expose an importable workspace entrypoint 12 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
@freelanceflow/ui package entrypoint should be directly importable 12 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
@freelanceflow/ui package entrypoint should be directly importable (reissue via #743) 12 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Job detail route should resolve mock jobs by id (reissue via #743) 12 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Settings page should provide actionable account controls 12 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Reject inverted job budget ranges in job validation 12 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Search endpoint has no input validation or length limit on query 12 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Reject inverted job budget ranges in job validation 12 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Freelancer profile route should resolve mock profiles by username 12 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty
SecureBananaLabs/bug-bounty
228

JavaScript
Calculate the exact value of PI #2872 12 days ago
bug documentation good first issue help wanted bug bounty AI agent friendly bounty $1.2k
SecureBananaLabs/bug-bounty
228

JavaScript
Calculate the exact value of PI 12 days ago
bug documentation good first issue help wanted bug bounty AI agent friendly bounty $1.2k
SecureBananaLabs/bug-bounty
228

JavaScript
Implement a fully functional Admin Panel 14 days ago
good first issue bug bounty AI agent friendly bounty 💎 Bounty $1k $1
SecureBananaLabs/bug-bounty
228

JavaScript
Bug: Proposal creation accepts records missing estimated duration 14 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
Registration token subject can drift from returned user id 14 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
fix(auth): prevent admin role self-assignment during registration 14 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
Bug: registerUser signs token with a different generated user id 14 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
Bug: Missing admin role authorization check on admin metrics endpoint 14 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
Bug: user creation accepts empty payloads and client-controlled ids 14 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
Payment endpoint lacks authentication — unauthenticated payment creation 14 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
Bug: Rate limiter should count malformed JSON before body parsing 15 days ago
bug good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $430
SecureBananaLabs/bug-bounty
228

JavaScript
auth refresh endpoint issues tokens without verifying the requester 24 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $780
SecureBananaLabs/bug-bounty
228

JavaScript
registerUser access token can reference a different user id 26 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $780
SecureBananaLabs/bug-bounty
228

JavaScript
upload endpoint accepts empty file submissions as successful uploads 26 days ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $780
SecureBananaLabs/bug-bounty
228

JavaScript
POST /api/users endpoint missing authentication middleware (reissue via #743) about 1 month ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $780
SecureBananaLabs/bug-bounty
228

JavaScript
POST /api/proposals endpoint missing authentication middleware (reissue via #743) about 1 month ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $780
SecureBananaLabs/bug-bounty
228

JavaScript
POST /api/reviews endpoint missing authentication middleware (reissue via #743) about 1 month ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $780
SecureBananaLabs/bug-bounty
228

JavaScript
CORS configured without origin allowlist in app.js (reissue via #743) about 1 month ago
bug enhancement good first issue help wanted bug bounty AI agent friendly bounty 💎 Bounty $780
SecureBananaLabs/bug-bounty
228

JavaScript