HackerOne · Report #26395
Notification of previous signed out user leakage.
Informativestatus
2upvotes
1 Sept 2014disclosed
How it was found
This is a very minor issue in my eye.But I would like to report,as hackerone itself is very cautious about its own security.
Steps to reproduce
- I logged on to hackerone with my team (@movielee) id.I saw that there were 6 notifications pending.I didnot checked those and logged out.
- I logged in to my regular account (@siddiki).And after the login,It was just a glance that the notification box showed 6 in that field.And then it was gone.
I should not get the glance of 6 pending notification of the previously signed out account. I think you will agree on this.