mailto: link injection on https://hackerone.com/directory

How it was found

I just found that entering a non-existing porogram returns the following response:

The Directory doesn't have a profile matching these criteria.

If an organization has published security contact information or a vulnerability disclosure policy, please let us know.

The bold part has a mailto: link which is in following format:

mailto:[email protected]?subject=Directory:<PROGRAM>

Now i tried the following URL which did my Spoofing Job.

POC Link

1. The user doesn't see the whole search term , so he thinks he is Helping hackerone add a new program.

2. Now he sends email (hackeone thretens not to change anything in email.

3. Unexpected action happens like Payemnt method chnage etc.