HackerOne · Report #313075
Information Disclosure which violate program privacy
Informativestatus
lowseverity
5upvotes
20 Feb 2018disclosed
How it was found
Summary: please refer to the following report: https://hackerone.com/reports/311289
It was noticed that TTS changed the summary and set the domain to example.gov as not to reveal to the public. But at the bottom of the page, "britta changed the scope from https://ci.fr.cloud.gov to None."
Recommendation: Should only provide general message for such situation: "britta changed the scope"
Impact
not much of impact. but violate Confidentiality of the program.