HexBrain

HackerOne · Report #452973

Inline banner on Report page discloses whether organization runs a private program

Validstatus
lowseverity
$500bounty
67upvotes
11 Dec 2018disclosed

How it was found

Summary: Hi team , @jobert Description:

Your engineers have created inscription - You are participating in a private program for ████████. Please do not publicly discuss the program until the program goes public.

When a hacker creates a report in an external program with a private page, we will see this inscription, which makes it clear that the program has a private part.

When a hacker creates a report in an external program that does not have a private page , we will not see this inscription.

It's more of a logical mistake. To fix this, I think you need to give the inscription in all reports for all programmes

Steps To Reproduce

  1. Create publish report for any programs

  2. If we are created report for ████████ , ██████████ , ... We will see the inscription - You are participating in a private program forname_program. Please do not publicly discuss the program until the program goes public. Because they have a private part

█████████

  1. if we are creted report for ████, ... We won't see the inscription . Because they have not a private part

██████████

Sorry i bad speak english I hope you understand me Thank you,haxta4ok00

Impact

disclosure of external programs with private

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original