HexBrain

Slack · Report #966814

Slack-Corp Heroku application disclosing limited info about company members

Validstatus
lowseverity
39upvotes
9 Dec 2020disclosed

Summary

@demonia brought it to our attention that two Slack employee email addresses were discoverable in a test application. There was zero risk to customer data.

Nothing special, A Heroku Appliction Without Authentication Has Been Discovered On The Linux Application Data Disclosing Limited Information About Some Slack employee, The Data Format Was: Name, Email , Slack User ID , Slack Team ID

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original