$1,000 HackerOne Bounty | Viewing redacted username information

#hackerone #bugbounty #informationsecurity

Report:

---------------------------------------

SUMMARY BY HACKERONE:

In our second iteration of this feature, we put it behind a feature flag and invited the hacker to deliver direct feedback to improve the accuracy of the feature, the below report is the outcome of that. We're happy with where the feature is at now as a balance of security vs convenience.

JAPZ SUMMARY

I submitted 3 different root cause including the one that is recorded in the poc video, though the poc video seems to be doesn't have any impact, the other 2 root cause have impact that's why it was rewarded $1,000

1. username was disclosed when tagging participants using @username feature
2. username was disclosed on the internal data, like custom field etc.
3. username disclosed in reference (this is recorded in the poc video)

---------------------------------------

Please note that the email address disclosed in the PoC video is my test dummy email, that being said no sensitive info on the PoC video.

[RuvelBajaro]

How to submit test reports like that sir sa hackerone?