HackerOne · Report #283309
Private Program all members disclosed
Duplicatestatus
8upvotes
16 Nov 2017disclosed
Summary
After receiving an invite to a private program, it was possible to view all of its team members:
https://hackerone.com/invitations/{invitation code}.json
"team_members":[{"username":"<censored>"},{"username":"<censored>"},{"username":"<censored>"},{"username":"<censored>"},{"username":"<censored>"},{"username":"<censored>"}]}}
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.