HackerOne · Report #127620
New hacktivity view discloses report IDs of non-public reports
Validstatus
$500bounty
10upvotes
5 Apr 2016disclosed
Summary
The new Hacktivity view unintentionally leaked the report IDs of non-public (undisclosed) reports. While report IDs on their own are not sensitive, the fact that the information was correlated with a specific team and researcher (as well as a bounty/swag action) lead to a metadata information disclosure that could be used to possibly glean information about the report (especially if the report ID was ever mentioned elsewhere, such as commit log or some other context).
How it was found
url: https://hackerone.com/hacktivity.json
this url reveals information of reporters Report id ./
██████████
i guess this is not Intensionally ?
Regards.