How it was found

Steps to reproduce

• sign in as any user
• visit https://hackerone.com/organizations/:handle/assets/download_pending_reviews.csv, where :handle is the organization you want to download the assets for

Impact

This may leak sensitive data about an organization's attack surface.