HexBrain

HackerOne · Report #240083

Updating payout preference to CurrencyCloud doesn't notify user via email

Validstatus
$500bounty
35upvotes
31 Jan 2018disclosed

How it was found

When change payment method in user's payments, then a notification about Change payment method is sent to the user (email).

However, user not always gets a notification about change payment method - when change payment method via add payout method on Payout Methods, then such a notification is not send to the user (email).

Also, when user try to change payment method , they were asked to verify the request by entering hackerone password. for the same reason a verification should be there on add payout method.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original