HackerOne · Report #196358
Report redaction doesn't apply to report title update activities
How it was found
Summary: The Redact option doesn't redact all keywords identified in the report- which may leave sensitive information unredacted.
Description (Include Impact):
The option only search through reporter's initial report & follow-up comments, leaving other comments untouched. Furthermore, it doesn't search in changes to report status. For better clarity, please refer to my screenshot attached.
For example, if a team member has changed the report title, it fails to redact changes. Any such status changes are left untouched which is insufficient prior to full disclosure IMO.
Steps To Reproduce
For easier reproduction, please;
- Change report Title prior to redact keywords
- Now, redact some texts from report title as in screenshot
Screenshots:
{F149867}