Program managers can see draft reports using Export Reports feature

How it was found

Summary:

Hello. I have discovered a bug in the new draft feature.

Program managers can see draft reports using Export Reports feature.

Steps To Reproduce

1. Make a draft (do not send) report on a public/private program.
2. Go to the https://hackerone.com/<program-handle>/export_reports page and export reports.
3. Check your e-mail and download the file got from HackerOne.
4. Check the CSV file:

{F1860656}

As you see, it says draft and disclosed report title, severity, weakness, etc.

When you try to find it in the program inbox you can't find it, so completely sure this is a bug.

{F1860658}

Impact

Program managers can see draft reports using Export Reports feature leads to PII disclosure without reporter permission.