Partial disclosure of report activity through new "Export as .zip" feature
High
Vulnerability Details
Hello Team,
I noticed a new feature has been launched, which allows to export report. Great feature.
But unfortunately it discloses comments of partially disclosed reports which supposed to be hidden..
###POC:
* Go to this partially disclosed report > https://hackerone.com/reports/██████████
* Click **Export** Button.
* You'll see comments are getting disclosed!
{F134909}
This way you can see all the partially disclosed reports comments.
Please let me know if you need more information!
Looking forward!
Actions
View on HackerOneReport Stats
- Report ID: 182358
- State: Closed
- Substate: resolved
- Upvotes: 341