HackerOne · Report #1133118
Hackerone is not properly deleting user id
Validstatus
mediumseverity
356upvotes
11 Jun 2021disclosed
How it was found
Summary: Long ago, i had an account on hackerone that is now deleted. I used the alias email provided by h1 to sigbup on a site for bug testing. To my surprise, i receive an email to my account routed from an alias email that should not exist.
Description:
Steps To Reproduce
- SignUp on H1
- Use h1 alias email to signup on some website
- Delete h1 account and the email still exists
Optional: Your Environment (Browser version, Device, etc)
Optional: Supporting Material/References (Screenshots)
- as you can see.the email i just received. You can check your database that █████ dont exist in your database coz I deleted the account long back..but you can see the email address .
███████
Impact
Privacy concern