HexBrain

HackerOne · Report #1133118

Hackerone is not properly deleting user id

Validstatus
mediumseverity
356upvotes
11 Jun 2021disclosed

How it was found

Summary: Long ago, i had an account on hackerone that is now deleted. I used the alias email provided by h1 to sigbup on a site for bug testing. To my surprise, i receive an email to my account routed from an alias email that should not exist.

Description:

Steps To Reproduce

  1. SignUp on H1
  2. Use h1 alias email to signup on some website
  3. Delete h1 account and the email still exists

Optional: Your Environment (Browser version, Device, etc)

Optional: Supporting Material/References (Screenshots)

  • as you can see.the email i just received. You can check your database that █████ dont exist in your database coz I deleted the account long back..but you can see the email address .

███████

Impact

Privacy concern

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original