Legal Robot · Report #213936
Token leakage by referrer
Validstatus
mediumseverity
7upvotes
19 Jul 2017disclosed
Summary
A security researcher discovered that password reset tokens were leaked to Intercom (which provides our support chat interface) and Google Analytics. While the time between a user clicking on a password reset link and actually resetting the password is typically quite low, there was still some risk.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.