HackerOne · Report #452973
Inline banner on Report page discloses whether organization runs a private program
How it was found
Summary: Hi team , @jobert Description:
Your engineers have created inscription - You are participating in a private program for ████████. Please do not publicly discuss the program until the program goes public.
When a hacker creates a report in an external program with a private page, we will see this inscription, which makes it clear that the program has a private part.
When a hacker creates a report in an external program that does not have a private page , we will not see this inscription.
It's more of a logical mistake. To fix this, I think you need to give the inscription in all reports for all programmes
Steps To Reproduce
-
Create publish report for any programs
-
If we are created report for ████████ , ██████████ , ... We will see the inscription -
You are participating in a private program forname_program. Please do not publicly discuss the program until the program goes public.Because they have a private part
█████████
- if we are creted report for ████, ... We won't see the inscription . Because they have not a private part
██████████
Sorry i bad speak english I hope you understand me Thank you,haxta4ok00
Impact
disclosure of external programs with private