HexBrain

HackerOne · Report #826176

program_analytics_benchmarks query shows information not visible in public

Validstatus
lowseverity
22upvotes
27 Mar 2020disclosed

How it was found

Summary: program_analytics_benchmarks is displaying information i don't see yet in public profile of a program.

Description: I tried querying program_analytics_benchmarks for the program security and ██████ and it showing information i cannot find in public profile especially in ███████

Steps To Reproduce

Please try the graphql for the the program security and ████████

{
  program_analytics_benchmarks(teams:"security" select:p50_time_to_bounty, from:response_targets, where:{severity:{is_null:true}},group:week_bounty_awarded_at, 
    start_date:"2019-10-01T00:00:00.000Z",end_date:"2020-10-01T00:00:00.000Z%00")
    {
      id
      x
      y
      
    }
}

Please see the attached file for the actual response

Optional: Supporting Material/References (Screenshots)

███ ███ *

I saved this graphql query and been trying to run this for a month now and i just noticed now that it's returning some information.

Impact

Information disclosure

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original