Total Paid Bounty Paid can be disclose

How it was found

Summary:

Hello HackerOne Bug Bounty Team,

I noticed that HackerOne recently updated their interface. Indeed, when a hacker hover his mouse over a program, it now disclose some new information : {F556858} The one that interested us is "Bounties sent in the last 90 days" value

Description:

This new feature could potentially disclose some program information that the team isn't willing to share. Indeed, this can happen in some scenario :

1- The program is 90 days or younger and has choose to not disclose the total paid amount. 2- The program is not 90 days or younger, but an automated script is continually tracking "Bounties sent in the last 90 days" value (note that this would give an exact number since the tracking has started or a very approximate number) (inspired from report #148050)

Impact

Total Paid Bounty Paid can be disclose