HackerOne · Report #80936
Private Program and bounty details disclosed as part of JSON search response
Validstatus
$500bounty
4upvotes
31 Aug 2015disclosed
How it was found
Hello Hackerone Team !!!!
Few days ago ████ invited me for Private disclose !!!
Yesterday I saw fix of this report #80597
So,I deepdigger the JSON serach Response
for example I search this directory
Now I access without authentication and i saw the private Program bounty details disclosed as part of JSON search response !!! ,So I assume its a register as private program in hackerone !!!
Response :
████base_bounty:████$
████base_bounty:████$