HexBrain

HackerOne · Report #1179241

Private program disclosure of `██████████` through notifications

Validstatus
lowseverity
$500bounty
66upvotes
9 Jun 2021disclosed

How it was found

Summary: Private program disclosure of ██████ through notifications

Description: It looks like there is a private program called ████████ - https://hackerone.com/████████ which I'm not yet invited yet. However, I received a notification alert in my H1 account notification box indicating the private program has posted a new message.

Steps To Reproduce

  1. Logged into my H1 account.

  2. Observed the below message in notification box

███

Also navigated to https://hackerone.com/notifications and was able to see the notification there as well. ████████

Impact

It seems like there is a private program called █████████ - https://hackerone.com/████ which I'm not yet invited yet. However, I received a notification alert in my H1 account notification box indicating the private program has posted a new message.

This indicates that there is a private program called https://hackerone.com/████

Thanks, @h13-

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original