Regarding the HackerOne program you can have a look at the bottom of this page: https://hackerone.com/dropbox and have a look for bug-report titles. These are the reports that were publicly disclosed and valid reports (won't-fixes are not in that list).

Or you might go for a search for "dropbox" here (that comes in handy if there are a lot of reports): http://h1.nobbd.de