HexBrain

HackerOne · Report #196358

Report redaction doesn't apply to report title update activities

Validstatus
lowseverity
27upvotes
25 Feb 2017disclosed

How it was found

Summary: The Redact option doesn't redact all keywords identified in the report- which may leave sensitive information unredacted.

Description (Include Impact): The option only search through reporter's initial report & follow-up comments, leaving other comments untouched. Furthermore, it doesn't search in changes to report status. For better clarity, please refer to my screenshot attached.
For example, if a team member has changed the report title, it fails to redact changes. Any such status changes are left untouched which is insufficient prior to full disclosure IMO.

Steps To Reproduce

For easier reproduction, please;

  1. Change report Title prior to redact keywords
  2. Now, redact some texts from report title as in screenshot

Screenshots:
{F149867}

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original