HackerOne · Report #2069593
Draft report exposure via slack alerting system for programs
Validstatus
mediumseverity
83upvotes
6 Oct 2023disclosed
Summary
A vulnerability was discovered that allowed comments on draft reports to be sent to a program's Slack workspace. This could potentially expose confidential information from draft reports. The issue was reported by @imranhudaa and validated by HackerOne. A fix was implemented so that activities from draft reports are no longer posted to Slack. HackerOne thanks the reporter for responsibly disclosing this issue.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.