Slack · Report #966814
Slack-Corp Heroku application disclosing limited info about company members
Validstatus
lowseverity
39upvotes
9 Dec 2020disclosed
Summary
@demonia brought it to our attention that two Slack employee email addresses were discoverable in a test application. There was zero risk to customer data.
Nothing special, A Heroku Appliction Without Authentication Has Been Discovered On The Linux Application Data Disclosing Limited Information About Some Slack employee, The Data Format Was: Name, Email , Slack User ID , Slack Team ID
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.