HexBrain

HackerOne · Report #271506

Banned researcher gets email updates on a private program.

Validstatus
139upvotes
18 May 2019disclosed

How it was found

Hi Team,

I found out that after getting banned from the program, I still getting email updates about the private program, e.g. access of beta product, new scope changes etc. Those private messages can contain some important data that program doesn't want to share with the banned researcher for ex some programs provide the special promo code for testing paid features. A banned researcher can than missuses the promo code. █████████

As per the fix of report #174449 banned hackers won't receive messages from those teams, However I am still receiving reports from the program which may contain the secret information.

Steps To Reproduce 1: I got banned from █████████ private program. █████ 2: Today, I received an email about that program new scope that is limited to selected researchers. █████

Let me know if more information is needed.

Thanks and Regards Mohit

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original