HexBrain

HackerOne · Report #2069593

Draft report exposure via slack alerting system for programs

Validstatus
mediumseverity
83upvotes
6 Oct 2023disclosed

Summary

A vulnerability was discovered that allowed comments on draft reports to be sent to a program's Slack workspace. This could potentially expose confidential information from draft reports. The issue was reported by @imranhudaa and validated by HackerOne. A fix was implemented so that activities from draft reports are no longer posted to Slack. HackerOne thanks the reporter for responsibly disclosing this issue.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original