HexBrain

HackerOne · Report #127620

New hacktivity view discloses report IDs of non-public reports

Validstatus
$500bounty
10upvotes
5 Apr 2016disclosed

Summary

The new Hacktivity view unintentionally leaked the report IDs of non-public (undisclosed) reports. While report IDs on their own are not sensitive, the fact that the information was correlated with a specific team and researcher (as well as a bounty/swag action) lead to a metadata information disclosure that could be used to possibly glean information about the report (especially if the report ID was ever mentioned elsewhere, such as commit log or some other context).

How it was found

url: https://hackerone.com/hacktivity.json

this url reveals information of reporters Report id ./

██████████

i guess this is not Intensionally ?

Regards.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original