[hackerone.com] Program's old handles are not blacklisted like usernames and allows reclaim over past handles for potential abuse

Summary

HackerOne has reviewed the report concerning the ability to claim and use old program handles/names after a program has changed its handle. While we understand the theoretical concern, we have determined this does not pose a significant security risk for the following reasons:

Clear Disclaimer: When an old program handle is claimed, a prominent disclaimer is automatically shown, stating "This page is not affiliated with [ProgramName]." This ensures that visitors are aware the page is community-edited and not an official program page.

Impersonation Prevention: Our controls are designed to detect and prevent any attempts at impersonation or misleading behavior leveraging claimed handles. Therefore, we are closing this report as informative. The ability to claim old handles does not enable impersonation of official programs without clear disclaimers.

However, we appreciate the report and the security researcher's efforts to identify potential risks.

We will continue to evaluate our processes, but at this time do not consider the claiming of old handles alone to constitute a security vulnerability that needs remediation.

When programs change their handles, Anyone can claim the released handle via Legacy pages and impersonate as real program but along with a brief disclaimer on right