Total Paid Bounty Paid can be disclose

Disclosed: 2020-02-28 17:36:38 By zrachessanasz To security
Low
Vulnerability Details
**Summary:** Hello HackerOne Bug Bounty Team, I noticed that HackerOne recently updated their interface. Indeed, when a hacker hover his mouse over a program, it now disclose some new information : {F556858} The one that interested us is "Bounties sent in the last 90 days" value **Description:** This new feature could potentially disclose some program information that the team isn't willing to share. Indeed, this can happen in some scenario : 1- The program is 90 days or younger and has choose to not disclose the total paid amount. 2- The program is not 90 days or younger, but an automated script is continually tracking "Bounties sent in the last 90 days" value (note that this would give an exact number since the tracking has started or a very approximate number) (inspired from report #148050) ## Impact Total Paid Bounty Paid can be disclose
Actions
View on HackerOne
Report Stats
  • Report ID: 674757
  • State: Closed
  • Substate: resolved
  • Upvotes: 161
Share this report