HackerOne · Report #386997
Private program policy page still accessible after user left the program
Validstatus
mediumseverity
$2,500bounty
57upvotes
12 Aug 2018disclosed
How it was found
Hi Team,
Summary:
I have found a critical sensitive information disclosure, I'm not sure if this is a result of a new hackerone UI update, I observed that some of the UI has been change such as Hacktivity etc.
BUG: Now all private program policy page together with the updates is visible to me despite i already leave to those private program!
WHOLE POLICY PAGE WAS DISCLOSED:
Below screenshot is the sample, the private program name is ██████ which i already LEAVE long time ago, but now i can see their policy page!
██████
Impact
Private program disclcosure.