Private Program Disclosure in /:handle/reports/draft.json endpoint

Summary

Analysis of the researcher's PoC revealed an issue in the HTTP codes returned for the /reports/draft.json endpoint:

sandboxed team: https://hackerone.com/[sandboxed team handle]/reports/draft.json Returned 401

EP (external program): https://hackerone.com/[external program handle]/reports/draft.json Returned 404

EP + private program: https://hackerone.com/[invite-only team handle]/reports/draft.json Returned 200 (empty response) <-- This is the information disclosure

private team without EP: https://hackerone.com/[invite-only team handle]/reports/draft.json Returned 401

public team: https://hackerone.com/[public team handle]/reports/draft.json Returned 200

user: https://hackerone.com/[user handle]/reports/draft.json Returned 404

We have corrected the issue by ensuring the same HTTP code is returned for both EP and EP + private program handles.